hyperliquids[.]claims

Analysis of hyperliquids.claims shows a high‑risk brand‑impersonation campaign targeting users of Hyperliquid. The domain was registered on February 21, 2026 through NiceNIC International Group Co., Limited and is hosted behind Cloudflare (AS13335) with the IP address 188.114.97.3 located in the United States. Infrastructure indicators include enforced HSTS, Cloudflare Browser Insights, and HTTP/3 support, and the site presents a generic "Just a moment..." title while returning HTTP 403 responses. Reputation data is uniformly negative: Gridinsoft assigns a trust score of 0/100, the domain appears on three security blocklists, and seven of ninety‑three VirusTotal scanners flag it as malicious. It is already blocked by multiple threat‑interception services, including PhishDestroy, MetaMask, and SEAL, and has been referenced in an AlienVault OTX pulse. While the exact malicious payload has not been disclosed, the convergence of brand impersonation, crypto‑scam classification, and multiple detections warrants immediate defensive action. Organizations should add hyperliquids.claims to URL filtering and DNS block lists, monitor for related traffic to the Cloudflare IP, and alert users about fraudulent Hyperliquid communications. Continuous monitoring for any changes in page content or additional infrastructure modifications is recommended.