v2-hyperliquid[.]app

Analysis of the domain v2-hyperliquid.app confirms its classification as a crypto scam impersonating the Hyperliquid brand. Registered on March 22, 2026, through Dynadot LLC, the domain currently resolves to the IP address 130.12.180.128, hosted by Virtualine Technologies in the Netherlands. Infrastructure analysis reveals the use of nameservers ns1.dyna-ns.net and ns2.dyna-ns.net, alongside technologies including PHP, Nginx, and OpenResty. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious domains.

At the time of assessment, the domain returned an HTTP 404 status, indicating no active content was accessible. However, prior intelligence confirms its association with crypto scam activity, as explicitly flagged by Gridinsoft with a trust score of 0/100. Detection engines on VirusTotal identified the domain as malicious, with 6 of 94 security vendors marking it as suspicious. The domain appears on three security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, further corroborating its malicious intent.

The domain's registration details, hosting provider, and detection history align with patterns observed in brand impersonation campaigns targeting cryptocurrency users. While the exact content of the site remains unanalyzed due to its offline status, the available evidence—including the domain name, scam classification, and blocklist presence—strongly supports its role in fraudulent activity. Defenders are advised to maintain blocks on this domain and monitor associated infrastructure, such as the IP address and nameservers, for further malicious activity. No additional indicators of compromise or campaign linkages have been identified at this time.