Hyperliquid

Crypto & web3hyperliquid.xyzRank 74 of the most impersonated
Cert findings · 24 h
7
Cert findings · 7 days
42
26 reported or listed · 16 on phishing hosts
Registered lookalikes
436
114 listed by a source or an address list
Official domains
2
verified from Hyperliquid's own sites and records

Certificate findings for Hyperliquid

Updated hourly · 2026-11-05 10:53 UTC

DomainSpoof matched these hostnames, from public certificate logs, to Hyperliquid's name or to lookalike spellings of its official domains. Each was reported or listed by one of our sources, or resolved to an address on Spamhaus DROP or DomainSpoof's phishing-host list.

Published now · 64 findings, grouped by hostname

  1. claimhyperliquid.org US · AS13335 · Cloudflare, Inc.4 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 8 mo ago
    DetailsHide
    Hostname
    claimhyperliquid.org
    First seen
    2026-11-05 10:36 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-05 09:34 UTC to 2027-02-03 09:34 UTC
    Logged 2026-11-05 10:33 UTC in Let's Encrypt Sycamore2027h1, entry 957,762,293
    SHA-256 626d7dfcabb0809d3bd1824434d590e3a02e18d7ed65d888edecb68d044b5a44
    Public key SHA-256 8ca4b516d14d7106ddc9676745da08612867c5b85b1dd56709ae1005d2578189
    PhishDestroy
    Brand
    Hyperliquid
    Addresses
    104.21.34.213 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.165.148 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3033::6815:22d5
    2606:4700:3035::ac43:a594
    Cloudflare
    Cloudflare (104.21.34.213, 172.67.165.148): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    claimhyperliquid.org
    Registered
    2026-03-14 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 10:40 UTC

    Suggest a correction

  2. treasury-hyperliquid.org US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    treasury-hyperliquid.org
    First seen
    2026-11-05 07:05 UTC
    First published
    2026-11-05 07:32 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 07:44 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-05 06:03 UTC to 2027-02-03 06:03 UTC
    Logged 2026-11-05 07:01 UTC in DigiCert Wyvern2027h1, entry 412,640,209
    SHA-256 dbba27eec148588d50d779711685d60e7b99496772e852dfe182372ef56ad05f
    Public key SHA-256 c475679c5964ac07bc73a8e1223c77ee3a01f0bbad088c60d66c065b75f0ad52
    Brand
    Hyperliquid
    Addresses
    104.21.69.228 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.214.153 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3033::ac43:d699
    2606:4700:3037::6815:45e4
    Cloudflare
    Cloudflare (104.21.69.228, 172.67.214.153): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    treasury-hyperliquid.org
    Registered
    2026-05-12 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 07:08 UTC

    Suggest a correction

  3. hyperliquid-v2.org US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 11 mo ago
    DetailsHide
    Hostname
    hyperliquid-v2.org
    First seen
    2026-11-05 02:46 UTC
    First published
    2026-11-05 02:59 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 03:11 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-05 01:43 UTC to 2027-02-03 02:42 UTC
    Logged 2026-11-05 02:43 UTC in Google ParcelYard2027h1, entry 618,622,706
    SHA-256 c03eb71195fbe8ca4b155cbcd70dbe882854bd6d3f60391103199b249ea5e047
    Public key SHA-256 2551fbcbab1b97e9fe538a6f86b7b98ab1b8b899187f9f445c7ac13484818685
    Brand
    Hyperliquid
    Addresses
    104.21.69.123 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.208.6 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3033::ac43:d006
    2606:4700:3037::6815:457b
    Cloudflare
    Cloudflare (104.21.69.123, 172.67.208.6): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    hyperliquid-v2.org
    Registered
    2025-12-12 · Porkbun LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 02:46 UTC

    Suggest a correction

  4. app-hyperliquid.net US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    app-hyperliquid.net
    First seen
    2026-11-04 23:26 UTC
    First published
    2026-11-05 00:41 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 00:49 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-04 22:21 UTC to 2027-02-02 23:19 UTC
    Logged 2026-11-04 23:21 UTC in Geomys Tuscolo2027h1, entry 479,084,811
    SHA-256 8271c9455db919d92ea9542963ca482f7187a4d772cb8b45fa11f2085a955a7f
    Public key SHA-256 ff137ababb38fceb96a145c1e7f126902f5b2508db859b2963a6d974d15f2015
    Brand
    Hyperliquid
    Addresses
    104.21.24.171 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.219.195 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3031::6815:18ab
    2606:4700:3035::ac43:dbc3
    Cloudflare
    Cloudflare (104.21.24.171, 172.67.219.195): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    app-hyperliquid.net
    Registered
    2026-04-28 · Atak Domain Bilgi Teknolojileri A.S.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 00:43 UTC

    Suggest a correction

  5. 1-policy-hyperliquidgov.pages.dev US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    1-policy-hyperliquidgov.pages.dev
    First seen
    2026-11-04 17:52 UTC
    First published
    2026-11-04 18:05 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-04 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 18:17 UTC
    Listed
    MetaMask
    1. Certificate logged in CT
    2. Observed in the MetaMask feed
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-04 10:27 UTC to 2027-02-02 11:25 UTC
    Logged 2026-11-04 11:27 UTC in IPng Networks Halloumi2027h1, entry 360,716,286
    SHA-256 408408568120d5f1d88f1f66dd6ee052218fdf9ad5778bab7e9b7da5aaeab916
    Public key SHA-256 7618db052788de659eec2b2b221c67d240b5e982893bac70cbc4f372ce4b3e38
    Brand
    Hyperliquid
    Addresses
    172.66.44.56 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.200 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:310c::ac42:2c38
    2606:4700:310c::ac42:2fc8
    Cloudflare
    Cloudflare (172.66.44.56, 172.66.47.200): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  6. policy-hyperliquidgov.icu US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 2 d ago
    DetailsHide
    Hostname
    policy-hyperliquidgov.icu
    First seen
    2026-11-04 11:51 UTC
    First published
    2026-11-04 13:12 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-04 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 13:32 UTC
    Listed
    MetaMask
    1. Certificate logged in CT
    2. Observed in the MetaMask feed
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-03 05:19 UTC to 2027-02-01 05:19 UTC
    Logged 2026-11-03 06:18 UTC in Google ParcelYard2027h1, entry 585,050,087
    SHA-256 2bff2884cc1054d1771ba2b47ed40c7d2dc9a3f363b9ca564d385ddcde683128
    Public key SHA-256 c11b2a23dfb1e3e53e096e8705e9defd8958d2886cce395548541d7a81e11221
    Brand
    Hyperliquid
    Addresses
    104.21.87.248 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.171.137 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3034::6815:57f8
    2606:4700:3037::ac43:ab89
    Cloudflare
    Cloudflare (104.21.87.248, 172.67.171.137): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    policy-hyperliquidgov.icu
    Registered
    2026-11-03 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 05:06 UTC

    Suggest a correction

  7. policy-hyperliquidgov.pages.dev US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    policy-hyperliquidgov.pages.dev
    First seen
    2026-11-04 11:51 UTC
    First published
    2026-11-04 13:12 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-04 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 13:32 UTC
    Listed
    MetaMask
    1. Certificate logged in CT
    2. Observed in the MetaMask feed
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-03 05:11 UTC to 2027-02-01 05:11 UTC
    Logged 2026-11-03 06:09 UTC in IPng Networks Gouda2027h1, entry 299,600,635
    SHA-256 8dfae2b89e856dbb8e2a35bdb8936c83676bed42ee6ecd973cfbde4731d8eb9a
    Public key SHA-256 77ca54566a73135ac8d513338babc93c3e2e532acd64c6309fec92954245b174
    Brand
    Hyperliquid
    Addresses
    172.66.44.100 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.156 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:310c::ac42:2c64
    2606:4700:310c::ac42:2f9c
    Cloudflare
    Cloudflare (172.66.44.100, 172.66.47.156): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  8. hyperliquid-box.xyz US · AS13335 · Cloudflare, Inc.4 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 10 mo ago
    DetailsHide
    Hostname
    hyperliquid-box.xyz
    First seen
    2026-11-04 09:46 UTC
    First published
    2026-11-04 10:38 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 10:49 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-04 08:44 UTC to 2027-02-02 09:41 UTC
    Logged 2026-11-04 09:44 UTC in Google ParcelYard2027h1, entry 606,114,297
    SHA-256 ec9558ff3dcffe5385215f8795fdf451920211e6d021e9fa30c66293240fe6eb
    Public key SHA-256 fce043f6d84f9ea9fe18db605f2ef5f3900e42cb87460eea97ff1a2f4f094de1
    PhishDestroy
    Brand
    Hyperliquid
    Addresses
    104.21.79.84 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.169.104 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3030::ac43:a968
    2606:4700:3033::6815:4f54
    Cloudflare
    Cloudflare (104.21.79.84, 172.67.169.104): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    hyperliquid-box.xyz
    Registered
    2026-01-12 · Global Domain Group LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 09:50 UTC

    Suggest a correction

  9. hyperliquid-site.top US · AS13335 · Cloudflare, Inc.4 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 10 mo ago
    DetailsHide
    Hostname
    hyperliquid-site.top
    First seen
    2026-11-04 07:46 UTC
    First published
    2026-11-04 08:03 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 08:17 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Sectigo Public Server Authentication CA DV E36 · precertificate
    Valid 2026-11-04 00:00 UTC to 2027-01-29 17:41 UTC
    Logged 2026-11-04 07:40 UTC in DigiCert Wyvern2027h1, entry 399,614,866
    SHA-256 6f93d2345b90538f0bf0febf3ebf4ffe766d340c66b11bcbd917cfe10f9039cc
    Public key SHA-256 bf9f0b9493f8af5892556e5fdf62fb8dd6e595dbff939ff563eb4eafb278dfa4
    PhishDestroy
    Brand
    Hyperliquid
    Addresses
    104.21.44.198 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.203.104 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3031::6815:2cc6
    2606:4700:3033::ac43:cb68
    Cloudflare
    Cloudflare (104.21.44.198, 172.67.203.104): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    hyperliquid-site.top
    Registered
    2026-01-10 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:25 UTC

    Suggest a correction

  10. www.hyperliquidmarket.org CY · AS47583 · AS-HOSTINGER Hostinger Inte…
    Phishing hostHostingerAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 23 mo ago
    DetailsHide
    Hostname
    www.hyperliquidmarket.org
    First seen
    2026-11-04 01:57 UTC
    First published
    2026-11-04 03:04 UTC
    DNS
    Resolves · checked 2026-11-05 03:17 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.57.91.91.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.57.91.91
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-04 00:54 UTC to 2027-02-02 00:54 UTC
    Logged 2026-11-04 01:53 UTC in Let's Encrypt Sycamore2027h1, entry 932,630,684
    SHA-256 284469589fa3f167247f759fd4e1807b3fa7867ffcbbf2998e88f0b7148cd52c
    Public key SHA-256 64825ec1eb7aad91e59b2caaa10f5ae98b81c9aa80eaf328314bc8ac96ff11ca
    Brand
    Hyperliquid
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    hyperliquidmarket.org
    Registered
    2024-12-01 · HOSTINGER operations, UAB
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 03:07 UTC

    Suggest a correction

  11. www.hyperliquidmarket.com CY · AS47583 · AS-HOSTINGER Hostinger Inte…
    Phishing hostHostingerAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 23 mo ago
    DetailsHide
    Hostname
    www.hyperliquidmarket.com
    First seen
    2026-11-04 01:57 UTC
    First published
    2026-11-04 03:04 UTC
    DNS
    Resolves · checked 2026-11-05 03:17 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.57.91.91.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.57.91.91
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-04 00:54 UTC to 2027-02-02 00:54 UTC
    Logged 2026-11-04 01:53 UTC in DigiCert Sphinx2027h1, entry 349,344,116
    SHA-256 e66adf826f12b1e5451d1fcabe855c45296272f9d4c9ce98278e8d2f6cdcd67b
    Public key SHA-256 036831164d95d19accc521c5573b8798b918e4ee552d9eb937a46b7baaebf3d7
    Brand
    Hyperliquid
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    hyperliquidmarket.com
    Registered
    2024-12-01 · HOSTINGER operations, UAB
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 03:07 UTC

    Suggest a correction

  12. hyperliquidmarket.org CY · AS47583 · AS-HOSTINGER Hostinger Inte…
    Phishing hostHostingerAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 23 mo ago
    DetailsHide
    Hostname
    hyperliquidmarket.org
    First seen
    2026-11-04 01:57 UTC
    First published
    2026-11-04 03:04 UTC
    DNS
    Resolves · checked 2026-11-05 03:17 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.57.91.91.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.57.91.91
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-04 00:54 UTC to 2027-02-02 00:54 UTC
    Logged 2026-11-04 01:53 UTC in Let's Encrypt Sycamore2027h1, entry 932,630,684
    SHA-256 284469589fa3f167247f759fd4e1807b3fa7867ffcbbf2998e88f0b7148cd52c
    Public key SHA-256 64825ec1eb7aad91e59b2caaa10f5ae98b81c9aa80eaf328314bc8ac96ff11ca
    Brand
    Hyperliquid
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    hyperliquidmarket.org
    Registered
    2024-12-01 · HOSTINGER operations, UAB
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 03:07 UTC

    Suggest a correction

  13. hyperliquidmarket.com CY · AS47583 · AS-HOSTINGER Hostinger Inte…
    Phishing hostHostingerAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 23 mo ago
    DetailsHide
    Hostname
    hyperliquidmarket.com
    First seen
    2026-11-04 01:57 UTC
    First published
    2026-11-04 03:04 UTC
    DNS
    Resolves · checked 2026-11-05 03:17 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.57.91.91.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.57.91.91
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-04 00:54 UTC to 2027-02-02 00:54 UTC
    Logged 2026-11-04 01:53 UTC in DigiCert Sphinx2027h1, entry 349,344,116
    SHA-256 e66adf826f12b1e5451d1fcabe855c45296272f9d4c9ce98278e8d2f6cdcd67b
    Public key SHA-256 036831164d95d19accc521c5573b8798b918e4ee552d9eb937a46b7baaebf3d7
    Brand
    Hyperliquid
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    hyperliquidmarket.com
    Registered
    2024-12-01 · HOSTINGER operations, UAB
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 03:07 UTC

    Suggest a correction

  14. asset-hyperliquid.app US · AS13335 · Cloudflare, Inc.4 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 10 mo ago
    DetailsHide
    Hostname
    asset-hyperliquid.app
    First seen
    2026-11-03 19:41 UTC
    First published
    2026-11-03 20:36 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 20:44 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-03 18:36 UTC to 2027-02-01 19:34 UTC
    Logged 2026-11-03 19:36 UTC in Google PlumbersArms2027h1, entry 596,309,463
    SHA-256 d5bd7b18a7586804ac84c7fccc59bb6defc69162851c76ed8604746ea4e97d97
    Public key SHA-256 c757242136e7ab92e109018c5729b48f95e160bdc8ad252331c26adb21ec1a80
    PhishDestroy
    Brand
    Hyperliquid
    Addresses
    104.21.71.243 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.172.100 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3031::ac43:ac64
    2606:4700:3034::6815:47f3
    Cloudflare
    Cloudflare (104.21.71.243, 172.67.172.100): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    asset-hyperliquid.app
    Registered
    2026-01-12 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 20:39 UTC

    Suggest a correction

  15. hyperliquid.services US · AS13335 · Cloudflare, Inc.4 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 2 d ago
    DetailsHide
    Hostname
    hyperliquid.services
    First seen
    2026-11-03 17:41 UTC
    First published
    2026-11-03 18:16 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 18:20 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-03 16:40 UTC to 2027-02-01 16:40 UTC
    Logged 2026-11-03 17:38 UTC in DigiCert Wyvern2027h1, entry 391,355,100
    SHA-256 488bed71669ed649fbcbf616bb3620a19fbcbf6f781ad467f152d410ce5ab2e2
    Public key SHA-256 fc0d8af7acc3842fbeaef2dade91d439400ed8e136536b65d23392ccce902e9c
    PhishDestroy
    Brand
    Hyperliquid
    Addresses
    104.21.2.69 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.128.220 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3030::6815:245
    2606:4700:3030::ac43:80dc
    Cloudflare
    Cloudflare (104.21.2.69, 172.67.128.220): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    hyperliquid.services
    Registered
    2026-11-03 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 18:19 UTC

    Suggest a correction

  16. hyperliquid.center US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC policy noneRegistered 3 mo ago
    DetailsHide
    Hostname
    hyperliquid.center
    First seen
    2026-11-03 01:51 UTC
    First published
    2026-11-03 02:31 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 02:45 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Sectigo Public Server Authentication CA DV E36 · precertificate
    Valid 2026-11-03 00:00 UTC to 2027-01-28 21:50 UTC
    Logged 2026-11-03 01:49 UTC in IPng Networks Gouda2027h1, entry 298,137,166
    SHA-256 8f5b783b87bf35e31030b20fba485286859769d88577e7bd19c0d5f388a8914d
    Public key SHA-256 52dab68a8c0fab1508f025f7080bdbbd39236d87fb8dac3770909eeb630d7fb8
    Brand
    Hyperliquid
    Addresses
    104.21.80.221 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.187.74 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3031::6815:50dd
    2606:4700:3037::ac43:bb4a
    Cloudflare
    Cloudflare (104.21.80.221, 172.67.187.74): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    hyperliquid.center
    Registered
    2026-08-05 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-05 03:07 UTC

    Suggest a correction

  17. app-hyperilquid.org US · AS13335 · Cloudflare, Inc.4 addressesLookalike of hyperliquid.xyz · similar-looking characters
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 8 mo ago
    DetailsHide
    Hostname
    app-hyperilquid.org
    First seen
    2026-11-02 20:51 UTC
    First published
    2026-11-02 21:07 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 21:19 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-02 19:51 UTC to 2027-01-31 19:51 UTC
    Logged 2026-11-02 20:50 UTC in Let's Encrypt Willow2027h1, entry 902,039,989
    SHA-256 6256d5785e7bca5bc18724130b49a7c09ced4ccbf259a9597ab5853fbadc1938
    Public key SHA-256 a0e73153da1a088ba2a40d19a8a987d8f51f43261e17fa84638574eaa399d6e2
    Brand
    Hyperliquid (spelled like hyperliquid.xyz with similar-looking characters)
    Addresses
    104.21.43.104 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.178.34 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3030::ac43:b222
    2606:4700:3035::6815:2b68
    Cloudflare
    Cloudflare (104.21.43.104, 172.67.178.34): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    app-hyperilquid.org
    Registered
    2026-03-09 · Squarespace Domains LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 21:33 UTC

    Suggest a correction

  18. www.hyperliquid-dex.at SC · AS206264 · AMARUTU-TECHNOLOGY Amarutu …
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    www.hyperliquid-dex.at
    First seen
    2026-11-02 20:16 UTC
    DNS
    Resolves · checked 2026-11-05 09:00 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 31.220.1.30.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 31.220.1.30
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-02 19:15 UTC to 2027-01-31 19:15 UTC
    Logged 2026-11-02 20:13 UTC in Geomys Tuscolo2027h1, entry 449,498,406
    SHA-256 834e931f41daeac51085c416e009e7c72c90da9a550431043e06e10ea9a0bfb1
    Public key SHA-256 119e1f8b665f79826b247c183d1a05af5756372ffc04739f7724c94b44a722bb
    Brand
    Hyperliquid
    Addresses
    31.220.1.30 · Seychelles · AS206264 AMARUTU-TECHNOLOGY Amarutu Technology Ltd
    Domain
    hyperliquid-dex.at
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 23:22 UTC

    Suggest a correction

  19. www.eu-hyperliquid.org SC · AS206264 · AMARUTU-TECHNOLOGY Amarutu …
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 17 d ago
    DetailsHide
    Hostname
    www.eu-hyperliquid.org
    First seen
    2026-11-02 20:16 UTC
    DNS
    Resolves · checked 2026-11-05 09:06 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 31.220.1.30.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 31.220.1.30
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-02 19:14 UTC to 2027-01-31 19:14 UTC
    Logged 2026-11-02 20:13 UTC in DigiCert Sphinx2027h1, entry 336,539,816
    SHA-256 bbee860a215be5b5eea1a7334f3a0d402602d4c4d4681bda9fd5c4c9883b61b3
    Public key SHA-256 4273f9d7197d095235b1de4f5a2553406e91a359d2375cfe5a2f98070fbc9dd4
    Brand
    Hyperliquid
    Addresses
    31.220.1.30 · Seychelles · AS206264 AMARUTU-TECHNOLOGY Amarutu Technology Ltd
    Domain
    eu-hyperliquid.org
    Registered
    2026-10-19 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 00:57 UTC

    Suggest a correction

  20. hyperliquid-dex.at SC · AS206264 · AMARUTU-TECHNOLOGY Amarutu …
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    hyperliquid-dex.at
    First seen
    2026-11-02 20:16 UTC
    DNS
    Resolves · checked 2026-11-05 09:02 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 31.220.1.30.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 31.220.1.30
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-02 19:15 UTC to 2027-01-31 19:15 UTC
    Logged 2026-11-02 20:13 UTC in Geomys Tuscolo2027h1, entry 449,498,406
    SHA-256 834e931f41daeac51085c416e009e7c72c90da9a550431043e06e10ea9a0bfb1
    Public key SHA-256 119e1f8b665f79826b247c183d1a05af5756372ffc04739f7724c94b44a722bb
    Brand
    Hyperliquid
    Addresses
    31.220.1.30 · Seychelles · AS206264 AMARUTU-TECHNOLOGY Amarutu Technology Ltd
    Domain
    hyperliquid-dex.at
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 23:22 UTC

    Suggest a correction

  21. eu-hyperliquid.org SC · AS206264 · AMARUTU-TECHNOLOGY Amarutu …
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 17 d ago
    DetailsHide
    Hostname
    eu-hyperliquid.org
    First seen
    2026-11-02 20:16 UTC
    DNS
    Resolves · checked 2026-11-05 08:59 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 31.220.1.30.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 31.220.1.30
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-02 19:14 UTC to 2027-01-31 19:14 UTC
    Logged 2026-11-02 20:13 UTC in DigiCert Sphinx2027h1, entry 336,539,816
    SHA-256 bbee860a215be5b5eea1a7334f3a0d402602d4c4d4681bda9fd5c4c9883b61b3
    Public key SHA-256 4273f9d7197d095235b1de4f5a2553406e91a359d2375cfe5a2f98070fbc9dd4
    Brand
    Hyperliquid
    Addresses
    31.220.1.30 · Seychelles · AS206264 AMARUTU-TECHNOLOGY Amarutu Technology Ltd
    Domain
    eu-hyperliquid.org
    Registered
    2026-10-19 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 00:57 UTC

    Suggest a correction

  22. us-hyperliquid.org US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 3 mo ago
    DetailsHide
    Hostname
    us-hyperliquid.org
    First seen
    2026-11-02 14:16 UTC
    First published
    2026-11-02 14:34 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 14:46 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-02 13:13 UTC to 2027-01-31 14:11 UTC
    Logged 2026-11-02 14:13 UTC in Geomys Tuscolo2027h1, entry 446,159,523
    SHA-256 25088948b8f03a7a7069ecec027c0a7f640d71b680200b95b488676a991aba15
    Public key SHA-256 2d8f48f3423ca922b1e6328fce51bb974bcbc0711ac0ee9cc1217dca7bfc22e3
    Brand
    Hyperliquid
    Addresses
    104.21.53.135 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.213.32 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3032::6815:3587
    2606:4700:3033::ac43:d520
    Cloudflare
    Cloudflare (104.21.53.135, 172.67.213.32): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    us-hyperliquid.org
    Registered
    2026-07-27 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 00:19 UTC

    Suggest a correction

  23. hyperliquid-bot.com US · AS13335 · Cloudflare, Inc.
    ReportedCloudflareReported by PhishDestroyMX presentSPF ~allDMARC policy noneRegistered 8 mo ago
    DetailsHide
    Hostname
    hyperliquid-bot.com
    First seen
    2026-11-02 00:35 UTC
    First published
    2026-11-02 01:04 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 01:09 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-01 23:30 UTC to 2027-01-31 00:30 UTC
    Logged 2026-11-02 00:30 UTC in Google ParcelYard2027h1, entry 563,438,663
    SHA-256 68a11392fb798ae1267835575bcb92ca6d98a2927df951c596468449492312e0
    Public key SHA-256 1830a972a9ace0aaef815a703fe5a0fade840091e434cf94dfc4deab4431d045
    PhishDestroy
    Brand
    Hyperliquid
    Addresses
    185.158.133.1 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (185.158.133.1): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    hyperliquid-bot.com
    Registered
    2026-03-08 · IONOS SE
    MX
    Receives mail at mx00.ionos.com, mx01.ionos.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-05 01:41 UTC

    Suggest a correction

  24. www.apptrade-hyperliquid.xyz CY · AS47583 · AS-HOSTINGER Hostinger Inte…
    Phishing hostHostingerAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    www.apptrade-hyperliquid.xyz
    First seen
    2026-11-02 00:11 UTC
    First published
    2026-11-02 01:04 UTC
    DNS
    Resolves · checked 2026-11-05 01:09 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 46.202.172.210.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 46.202.172.210
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-01 23:10 UTC to 2027-01-30 23:10 UTC
    Logged 2026-11-02 00:08 UTC in DigiCert Wyvern2027h1, entry 376,305,443
    SHA-256 0a9ad78220fceb982f0916a067f9d137b29c5cb5fe10813e9ab1ed27c04ddf51
    Public key SHA-256 1fc23c595dffc9e656c30b8764d6533b93ca5ec3a343ac426d15fc23fba58c9a
    Brand
    Hyperliquid
    Addresses
    46.202.172.210 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (46.202.172.210): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    apptrade-hyperliquid.xyz
    Registered
    2026-05-06 · HOSTINGER operations, UAB
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 01:41 UTC

    Suggest a correction

  25. apptrade-hyperliquid.xyz CY · AS47583 · AS-HOSTINGER Hostinger Inte…
    Phishing hostHostingerAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    apptrade-hyperliquid.xyz
    First seen
    2026-11-02 00:10 UTC
    First published
    2026-11-02 01:04 UTC
    DNS
    Resolves · checked 2026-11-05 01:09 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 46.202.172.210.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 46.202.172.210
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-01 23:10 UTC to 2027-01-30 23:10 UTC
    Logged 2026-11-02 00:08 UTC in DigiCert Wyvern2027h1, entry 376,305,443
    SHA-256 0a9ad78220fceb982f0916a067f9d137b29c5cb5fe10813e9ab1ed27c04ddf51
    Public key SHA-256 1fc23c595dffc9e656c30b8764d6533b93ca5ec3a343ac426d15fc23fba58c9a
    Brand
    Hyperliquid
    Addresses
    46.202.172.210 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (46.202.172.210): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    apptrade-hyperliquid.xyz
    Registered
    2026-05-06 · HOSTINGER operations, UAB
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 01:41 UTC

    Suggest a correction

  26. webapp-hyperliquid.xyz
    ListedListed by MetaMaskMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    webapp-hyperliquid.xyz
    First seen
    2026-10-31 20:56 UTC
    First published
    2026-10-31 21:14 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Not resolving since 2026-10-31 · checked 2026-11-04 21:20 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-10-31 19:53 UTC to 2027-01-29 20:52 UTC
    Logged 2026-10-31 20:53 UTC in DigiCert Sphinx2027h1, entry 324,695,747
    SHA-256 f21ed48becaa12ec631dc7d29fe93578f310af51d8b3899809deb7b3c86e1658
    Public key SHA-256 69ef9faf28d8c24f621ca0d345836ba5c9caeaac2baf426c0302851e05d88086
    Brand
    Hyperliquid
    Domain
    webapp-hyperliquid.xyz
    Registered
    2026-09-02 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 00:13 UTC

    Suggest a correction

  27. hyperliquid-inc.com US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    hyperliquid-inc.com
    First seen
    2026-10-31 13:00 UTC
    First published
    2026-10-31 13:42 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 13:55 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-10-31 11:59 UTC to 2027-01-29 11:59 UTC
    Logged 2026-10-31 12:57 UTC in IPng Networks Halloumi2027h1, entry 321,348,533
    SHA-256 d0ff8ca27e41d9d3845db87e3b40eddcf60ec0cba2c455b3353078c3e7066ebd
    Public key SHA-256 590c7a827471ec03aa74efa71c9f96d8306c262ac3866b2db61e8e743dc6f40a
    Brand
    Hyperliquid
    Addresses
    104.21.59.44 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.213.201 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3031::6815:3b2c
    2606:4700:3033::ac43:d5c9
    Cloudflare
    Cloudflare (104.21.59.44, 172.67.213.201): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    hyperliquid-inc.com
    Registered
    2026-07-05 · West263 International Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 14:34 UTC

    Suggest a correction

  28. m.hyperliquid-inc.com US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareUnder hyperliquid-inc.com, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    m.hyperliquid-inc.com
    First seen
    2026-10-31 13:00 UTC
    First published
    2026-10-31 13:42 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 13:55 UTC
    Listed
    MetaMask, listing hyperliquid-inc.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-10-31 11:59 UTC to 2027-01-29 11:59 UTC
    Logged 2026-10-31 12:57 UTC in IPng Networks Halloumi2027h1, entry 321,348,533
    SHA-256 d0ff8ca27e41d9d3845db87e3b40eddcf60ec0cba2c455b3353078c3e7066ebd
    Public key SHA-256 590c7a827471ec03aa74efa71c9f96d8306c262ac3866b2db61e8e743dc6f40a
    Brand
    Hyperliquid
    Addresses
    104.21.59.44 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.213.201 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3031::6815:3b2c
    2606:4700:3033::ac43:d5c9
    Cloudflare
    Cloudflare (104.21.59.44, 172.67.213.201): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    hyperliquid-inc.com
    Registered
    2026-07-05 · West263 International Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 14:34 UTC

    Suggest a correction

  29. www.hyperliquid-inc.com US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareUnder hyperliquid-inc.com, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    www.hyperliquid-inc.com
    First seen
    2026-10-31 13:00 UTC
    First published
    2026-10-31 13:42 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 13:55 UTC
    Listed
    MetaMask, listing hyperliquid-inc.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-10-31 11:59 UTC to 2027-01-29 11:59 UTC
    Logged 2026-10-31 12:57 UTC in IPng Networks Halloumi2027h1, entry 321,348,533
    SHA-256 d0ff8ca27e41d9d3845db87e3b40eddcf60ec0cba2c455b3353078c3e7066ebd
    Public key SHA-256 590c7a827471ec03aa74efa71c9f96d8306c262ac3866b2db61e8e743dc6f40a
    Brand
    Hyperliquid
    Addresses
    104.21.59.44 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.213.201 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3031::6815:3b2c
    2606:4700:3033::ac43:d5c9
    Cloudflare
    Cloudflare (104.21.59.44, 172.67.213.201): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    hyperliquid-inc.com
    Registered
    2026-07-05 · West263 International Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 14:34 UTC

    Suggest a correction

  30. airdrop-hyperliquid.money US · AS13335 · Cloudflare, Inc.4 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 8 mo ago
    DetailsHide
    Hostname
    airdrop-hyperliquid.money
    First seen
    2026-10-31 11:21 UTC
    First published
    2026-10-31 11:51 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 11:55 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-10-31 10:19 UTC to 2027-01-29 10:19 UTC
    Logged 2026-10-31 11:18 UTC in DigiCert Wyvern2027h1, entry 366,469,518
    SHA-256 03b15af1b17d667fae886bcd95e67b9ee9c38fac72796d275e8c072790da2ae2
    Public key SHA-256 a1420988afbd8343b179831f0224673331fab933597e988f925eb863a38530e1
    PhishDestroy
    Brand
    Hyperliquid
    Addresses
    104.21.93.89 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.208.53 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3032::6815:5d59
    2606:4700:3036::ac43:d035
    Cloudflare
    Cloudflare (104.21.93.89, 172.67.208.53): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    airdrop-hyperliquid.money
    Registered
    2026-03-08 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 13:27 UTC

    Suggest a correction

  31. hyperliquid-airdrop.net US · AS13335 · Cloudflare, Inc.4 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    hyperliquid-airdrop.net
    First seen
    2026-10-31 09:57 UTC
    First published
    2026-10-31 10:16 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 10:24 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-10-31 08:57 UTC to 2027-01-29 08:57 UTC
    Logged 2026-10-31 09:55 UTC in Google ParcelYard2027h1, entry 536,991,072
    SHA-256 612e5e250dab47d96108cb1a75027ca38c864b54a973a3500e8cf6b2801345ec
    Public key SHA-256 c111014b59002e28a8547f1c4a274bcc1f2fb8aeb6c8aba657ec42717df65fd0
    PhishDestroy
    Brand
    Hyperliquid
    Addresses
    104.21.90.224 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.205.173 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3032::6815:5ae0
    2606:4700:3036::ac43:cdad
    Cloudflare
    Cloudflare (104.21.90.224, 172.67.205.173): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    hyperliquid-airdrop.net
    Registered
    2026-05-07 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 13:27 UTC

    Suggest a correction

  32. submit-hyperliquid.com US · AS13335 · Cloudflare, Inc.4 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 11 mo ago
    DetailsHide
    Hostname
    submit-hyperliquid.com
    First seen
    2026-10-31 06:46 UTC
    First published
    2026-10-31 07:17 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 07:22 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Sectigo Public Server Authentication CA DV E36 · precertificate
    Valid 2026-10-31 00:00 UTC to 2027-01-15 09:40 UTC
    Logged 2026-10-31 06:43 UTC in DigiCert Wyvern2027h1, entry 365,398,597
    SHA-256 725af92a5b1f6b3ce019cfd48c80bae54877863dff51b9237671aad0f8130d8b
    Public key SHA-256 d4290b8752ca8f373b2be7dacdceca27b37d8ad9dcf3100e250f7867777ba5aa
    PhishDestroy
    Brand
    Hyperliquid
    Addresses
    104.21.1.3 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.186.110 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3030::6815:103
    2606:4700:3035::ac43:ba6e
    Cloudflare
    Cloudflare (104.21.1.3, 172.67.186.110): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    submit-hyperliquid.com
    Registered
    2025-12-01 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:54 UTC

    Suggest a correction

  33. hyperliquid.app US · AS16509 · Amazon.com, Inc.
    ReportedParking page · Dynadot parkingReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 18 mo ago
    DetailsHide
    Hostname
    hyperliquid.app
    First seen
    2026-10-31 04:21 UTC
    First published
    2026-10-31 05:05 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 05:18 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-10-31 03:19 UTC to 2027-01-29 03:19 UTC
    Logged 2026-10-31 04:18 UTC in Let's Encrypt Willow2027h1, entry 859,298,996
    SHA-256 7150d2d43bd35f9b03f751f47c8a0c4b7190f0d617df58d765497ea1f2440ea4
    Public key SHA-256 1a27027df311679a0cc5e6de5875af785d074d9db292d510ec9c98a2d1a51af1
    PhishDestroy
    Brand
    Hyperliquid
    Addresses
    54.215.31.113 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Dynadot parking (parking page)
    Parking page · Dynadot parking
    Dynadot parking (54.215.31.113): a parking service. It answers for names that are typically for sale or unused.
    Domain
    hyperliquid.app
    Registered
    2025-05-17 · Dynadot LLC.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 06:43 UTC

    Suggest a correction

  34. register-hyperliquid.cfd US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    register-hyperliquid.cfd
    First seen
    2026-10-30 09:05 UTC
    First published
    2026-10-30 09:42 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 09:51 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-10-30 08:04 UTC to 2027-01-28 09:03 UTC
    Logged 2026-10-30 09:04 UTC in Geomys Tuscolo2027h1, entry 405,514,706
    SHA-256 97cd15168565bff3a8768351cd1778aadbf4b903f1d0e7c6f240ab962853c217
    Public key SHA-256 85fbcd3cd9faead839bc447b0cd70129115e30bf058440be2bd2f40551b37d56
    Brand
    Hyperliquid
    Addresses
    104.21.21.134 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.198.214 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3033::6815:1586
    2606:4700:3036::ac43:c6d6
    Cloudflare
    Cloudflare (104.21.21.134, 172.67.198.214): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    register-hyperliquid.cfd
    Registered
    2026-09-01 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 00:13 UTC

    Suggest a correction

  35. hyperliquid-claiming.app US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    hyperliquid-claiming.app
    First seen
    2026-10-30 01:36 UTC
    First published
    2026-10-30 01:51 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 02:04 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-10-30 00:36 UTC to 2027-01-28 00:36 UTC
    Logged 2026-10-30 01:35 UTC in Let's Encrypt Sycamore2027h1, entry 847,960,356
    SHA-256 034d7ed4e40190ec0272981c4641edf4bb2f86ce8dc987b9e1b5da8ecbd5549d
    Public key SHA-256 11f73569ae3982b04785b321edcbb241e92b22c43d306379b51fbf43476bbe01
    Brand
    Hyperliquid
    Addresses
    104.21.33.61 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.141.184 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3033::ac43:8db8
    2606:4700:3035::6815:213d
    Cloudflare
    Cloudflare (104.21.33.61, 172.67.141.184): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    hyperliquid-claiming.app
    Registered
    2026-06-29 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 03:54 UTC

    Suggest a correction

  36. hyperliquid-rewards.app US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    hyperliquid-rewards.app
    First seen
    2026-10-29 17:41 UTC
    First published
    2026-10-29 18:29 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 18:34 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-10-25 18:43 UTC to 2027-01-23 19:41 UTC
    Logged 2026-10-29 17:39 UTC in DigiCert Wyvern2027h1, entry 350,388,715
    SHA-256 10085dfe4fa7edc51ff92fee389eeaab15417a303e179f89767349e0e23ebcdb
    Public key SHA-256 a69a12b42c8d392e71eb26f0fd7616c95b51e9ea9be54d35741f82d26364aa19
    Brand
    Hyperliquid
    Addresses
    104.21.18.89 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.181.133 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3031::6815:1259
    2606:4700:3034::ac43:b585
    Cloudflare
    Cloudflare (104.21.18.89, 172.67.181.133): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    hyperliquid-rewards.app
    Registered
    2026-06-29 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 20:39 UTC

    Suggest a correction

  37. hyperliquid.cryptopayment.xyz US · AS14061 · DigitalOcean, LLC
    ListedDigitalOceanUnder cryptopayment.xyz, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 y ago
    DetailsHide
    Hostname
    hyperliquid.cryptopayment.xyz
    First seen
    2026-10-29 10:40 UTC
    First published
    2026-10-29 10:53 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 11:02 UTC
    Listed
    MetaMask, listing cryptopayment.xyz and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-10-29 09:37 UTC to 2027-01-27 09:37 UTC
    Logged 2026-10-29 10:36 UTC in Google ParcelYard2027h1, entry 504,152,148
    SHA-256 73ed45f148ce65b0f5c4746b96d6586a5fb33bf02a307618b723c2689464c559
    Public key SHA-256 c035614eff75ace3c0a7f167ed6819c739f8f8c4a3d6323f316fa46cedc58c60
    Brand
    Hyperliquid
    Addresses
    143.244.211.82 · United States · AS14061 DIGITALOCEAN-ASN - DigitalOcean, LLC · DigitalOcean (cloud provider)
    DigitalOcean
    DigitalOcean (143.244.211.82): a cloud provider. It rents servers and addresses to its customers.
    Domain
    cryptopayment.xyz
    Registered
    2020-11-20 · Interstellar Registrar Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 17:09 UTC

    Suggest a correction

  38. genesis-hyperliquid.xyz US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    genesis-hyperliquid.xyz
    First seen
    2026-10-29 09:15 UTC
    First published
    2026-10-29 09:51 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 10:02 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-10-29 08:15 UTC to 2027-01-27 09:12 UTC
    Logged 2026-10-29 09:15 UTC in Let's Encrypt Sycamore2027h1, entry 835,714,043
    SHA-256 cee1cbe3fbfcbd91e178ef7ddeab37912644413a85d61696e35a687657b024cc
    Public key SHA-256 001df6e52a68e302f6c0469a47f286bafe3f6ab03abe2a34dbc6ac283a21b1bf
    Brand
    Hyperliquid
    Addresses
    104.21.75.192 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.180.226 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3034::6815:4bc0
    2606:4700:3037::ac43:b4e2
    Cloudflare
    Cloudflare (104.21.75.192, 172.67.180.226): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    genesis-hyperliquid.xyz
    Registered
    2026-08-31 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 10:06 UTC

    Suggest a correction

  39. signup-hyperliquid.info US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    signup-hyperliquid.info
    First seen
    2026-10-29 07:41 UTC
    First published
    2026-10-29 07:46 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 07:51 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-10-29 06:37 UTC to 2027-01-27 07:35 UTC
    Logged 2026-10-29 07:37 UTC in Google ParcelYard2027h1, entry 501,866,536
    SHA-256 9ed32b2b7627d20d6bec00d5c4de0bd8f02f25b2fc5cb1fbbba92e378644bc15
    Public key SHA-256 89824dcf80eba35d775aea55a3f2f1b0b007df2cfed0b8a3d59fa88a3f4075f1
    Brand
    Hyperliquid
    Addresses
    104.21.41.146 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.191.58 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3035::ac43:bf3a
    2606:4700:3037::6815:2992
    Cloudflare
    Cloudflare (104.21.41.146, 172.67.191.58): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    signup-hyperliquid.info
    Registered
    2026-08-31 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 10:04 UTC

    Suggest a correction

  40. connects-hyperliquid.xyz
    ListedListed by MetaMaskMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    connects-hyperliquid.xyz
    First seen
    2026-10-28 23:05 UTC
    First published
    2026-10-28 23:28 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Not resolving since 2026-10-28 · checked 2026-11-04 23:41 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-10-28 22:04 UTC to 2027-01-26 23:03 UTC
    Logged 2026-10-28 23:04 UTC in Google ParcelYard2027h1, entry 496,256,098
    SHA-256 0c8660007c2aad7ec6faf1ce2e16db1990e4036310086b8743709c997774aaa5
    Public key SHA-256 8f2c1463237bc80c51742688f3876aedcf7eb6290431eef90a3d73e7cdbaaf23
    Brand
    Hyperliquid
    Domain
    connects-hyperliquid.xyz
    Registered
    2026-08-30 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 01:42 UTC

    Suggest a correction

  41. rewards-hyperliquid.app US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    rewards-hyperliquid.app
    First seen
    2026-10-28 21:26 UTC
    First published
    2026-10-28 22:27 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 22:41 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-10-28 20:24 UTC to 2027-01-26 20:24 UTC
    Logged 2026-10-28 21:22 UTC in IPng Networks Halloumi2027h1, entry 293,198,463
    SHA-256 ac407fbfaf80c234c672a3c5ee2999a44c91d99c28b8222bf49db1e4663400bc
    Public key SHA-256 2a2a12077a8067934df15ffed6ed743145c730e8d7d71f14aaf90e6ded9fdcbc
    Brand
    Hyperliquid
    Addresses
    104.21.70.224 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.140.38 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3031::6815:46e0
    2606:4700:3035::ac43:8c26
    Cloudflare
    Cloudflare (104.21.70.224, 172.67.140.38): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    rewards-hyperliquid.app
    Registered
    2026-08-26 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 00:33 UTC

    Suggest a correction

  42. hyperliquid.casa MD · AS200019 · AlexHost ALEXHOST S.R.L.
    ReportedPhishing hostReported by PhishDestroy · Address hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    hyperliquid.casa
    First seen
    2026-10-28 12:26 UTC
    First published
    2026-10-28 13:04 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · delisted on 2026-10-30
    DNS
    Resolves · checked 2026-11-04 13:20 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 85.137.248.223.
    1. Phishing-host list fetched with the address
    2. Resolved to 85.137.248.223
    3. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-10-28 11:26 UTC to 2027-01-26 11:26 UTC
    Logged 2026-10-28 12:24 UTC in IPng Networks Halloumi2027h1, entry 288,411,930
    SHA-256 4935b5c676324d7814298c28ae2cc95e786f0c75ab8757c136d4d989a2cd40fe
    Public key SHA-256 e776a0b97f123cb951a7f208be9fd89620658ea4310e5420b252a58fd65ec89d
    PhishDestroy
    Brand
    Hyperliquid
    Addresses
    85.137.248.223 · Moldova · AS200019 AlexHost ALEXHOST S.R.L.
    Domain
    hyperliquid.casa
    Registered
    2026-05-04 · NameSilo, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 16:53 UTC

    Suggest a correction

  43. www.hyperliquidapp.at US · AS214036 · ULTAHOST-AS Ultahost, Inc.
    ReportedPhishing hostUnder hyperliquidapp.at, reported by PhishDestroy · Address hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    www.hyperliquidapp.at
    First seen
    2026-10-28 10:41 UTC
    First published
    2026-10-28 11:02 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 11:08 UTC
    Reported
    PhishDestroy, listing hyperliquidapp.at and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 192.142.18.210.
    1. Phishing-host list fetched with the address
    2. Resolved to 192.142.18.210
    3. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-10-28 09:40 UTC to 2027-01-26 09:40 UTC
    Logged 2026-10-28 10:38 UTC in IPng Networks Gouda2027h1, entry 247,135,902
    SHA-256 38f2623b1654a7b44ca14749c0b78a343fdaa209bc75a142e55925473c3a0771
    Public key SHA-256 3dbc5967043f4ee7229bb55148461e2b14021fa6d88da84d4a40b457486b4332
    PhishDestroy
    Brand
    Hyperliquid
    Addresses
    192.142.18.210 · United States · AS214036 ULTAHOST-AS Ultahost, Inc.
    Domain
    hyperliquidapp.at
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 14:35 UTC

    Suggest a correction

  44. hyperliquidapp.at US · AS214036 · ULTAHOST-AS Ultahost, Inc.
    ReportedPhishing hostReported by PhishDestroy · Address hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    hyperliquidapp.at
    First seen
    2026-10-28 10:41 UTC
    First published
    2026-10-28 11:02 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 11:08 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 192.142.18.210.
    1. Phishing-host list fetched with the address
    2. Resolved to 192.142.18.210
    3. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-10-28 09:40 UTC to 2027-01-26 09:40 UTC
    Logged 2026-10-28 10:38 UTC in IPng Networks Gouda2027h1, entry 247,135,902
    SHA-256 38f2623b1654a7b44ca14749c0b78a343fdaa209bc75a142e55925473c3a0771
    Public key SHA-256 3dbc5967043f4ee7229bb55148461e2b14021fa6d88da84d4a40b457486b4332
    PhishDestroy
    Brand
    Hyperliquid
    Addresses
    192.142.18.210 · United States · AS214036 ULTAHOST-AS Ultahost, Inc.
    Domain
    hyperliquidapp.at
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 14:35 UTC

    Suggest a correction

  45. app-hyperliquid-s4.com US · AS13335 · Cloudflare, Inc.4 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    app-hyperliquid-s4.com
    First seen
    2026-10-27 23:21 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 09:00 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-10-27 22:19 UTC to 2027-01-25 22:19 UTC
    Logged 2026-10-27 23:17 UTC in DigiCert Sphinx2027h1, entry 287,850,208
    SHA-256 0ab1bf30e0c7dd64dfce4d188d7f650a2541d2f8b98089d59ac94f42b24d28a7
    Public key SHA-256 a234ebe07007fe7f00c3ae8967109ffe662e665bfc8dfdaf41ad7c96595174c5
    PhishDestroy
    Brand
    Hyperliquid
    Addresses
    104.21.53.79 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.210.177 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3035::6815:354f
    2606:4700:3036::ac43:d2b1
    Cloudflare
    Cloudflare (104.21.53.79, 172.67.210.177): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    app-hyperliquid-s4.com
    Registered
    2026-06-27 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:35 UTC

    Suggest a correction

  46. www.hyperliquid-eth.com SC · AS206264 · AMARUTU-TECHNOLOGY Amarutu …
    ListedPhishing hostUnder hyperliquid-eth.com, listed by MetaMask · Address hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 17 d ago
    DetailsHide
    Hostname
    www.hyperliquid-eth.com
    First seen
    2026-10-27 21:00 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 09:01 UTC
    Listed
    MetaMask, listing hyperliquid-eth.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 31.220.1.30.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 31.220.1.30
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-10-27 19:58 UTC to 2027-01-25 19:58 UTC
    Logged 2026-10-27 20:57 UTC in Google ParcelYard2027h1, entry 477,490,479
    SHA-256 3de3e9860bfc489723ee57f20d7d67d710877045653b7edbf5470adf8dba0a4a
    Public key SHA-256 ddba98f771918be8c603a386f35785260e82ab7db914f4cc4326948bf476f91d
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-02 19:15 UTC to 2027-01-31 19:15 UTC
    Logged 2026-11-02 20:14 UTC in Let's Encrypt Willow2027h1, entry 901,602,892
    SHA-256 6327cb79af4629ec1c775af6e93a0e4963a96301ff3cf0f8f61668ddc3065b31
    Public key SHA-256 bf38c18b083e4f61b7a1d19b3c6549754f3973f1597c266d4d188652d0be7f6a
    Brand
    Hyperliquid
    Addresses
    31.220.1.30 · Seychelles · AS206264 AMARUTU-TECHNOLOGY Amarutu Technology Ltd
    Domain
    hyperliquid-eth.com
    Registered
    2026-10-19 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 00:33 UTC

    Suggest a correction

  47. www.hyperliquid-btc.com SC · AS206264 · AMARUTU-TECHNOLOGY Amarutu …
    ListedPhishing hostUnder hyperliquid-btc.com, listed by MetaMask · Address hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 17 d ago
    DetailsHide
    Hostname
    www.hyperliquid-btc.com
    First seen
    2026-10-27 21:00 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 09:01 UTC
    Listed
    MetaMask, listing hyperliquid-btc.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 31.220.1.30.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 31.220.1.30
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-10-27 19:58 UTC to 2027-01-25 19:58 UTC
    Logged 2026-10-27 20:56 UTC in Google PlumbersArms2027h1, entry 478,178,899
    SHA-256 ca3d46be3e9bc2badd8a06d6941d33ebcab06045a590741481b12dd0a94a1150
    Public key SHA-256 6b7c29048e15f489849804503fc5168f2fedee6ba413ebd35f8eb45d00f51bdf
    Certificate
    Issued by YR1
    Valid 2026-11-02 19:16 UTC to 2027-01-31 19:16 UTC
    Logged 2026-11-02 20:14 UTC in IPng Networks Halloumi2027h1, entry 341,297,545
    SHA-256 5bbe6eab752ba2085499d7f6464fcdf5ab1c8cf4634dd8d6ba27b81a9d48f232
    Public key SHA-256 6bed78063f4f1961fc5d64a742f798f6936b1ccfeb4c8d51a7be1588eab257b4
    Brand
    Hyperliquid
    Addresses
    31.220.1.30 · Seychelles · AS206264 AMARUTU-TECHNOLOGY Amarutu Technology Ltd
    Domain
    hyperliquid-btc.com
    Registered
    2026-10-19 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 00:33 UTC

    Suggest a correction

  48. hyperliquid-eth.com SC · AS206264 · AMARUTU-TECHNOLOGY Amarutu …
    ListedPhishing hostListed by MetaMask · Address hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 17 d ago
    DetailsHide
    Hostname
    hyperliquid-eth.com
    First seen
    2026-10-27 21:00 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 08:59 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 31.220.1.30.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 31.220.1.30
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-10-27 19:58 UTC to 2027-01-25 19:58 UTC
    Logged 2026-10-27 20:57 UTC in Google ParcelYard2027h1, entry 477,490,479
    SHA-256 3de3e9860bfc489723ee57f20d7d67d710877045653b7edbf5470adf8dba0a4a
    Public key SHA-256 ddba98f771918be8c603a386f35785260e82ab7db914f4cc4326948bf476f91d
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-02 19:15 UTC to 2027-01-31 19:15 UTC
    Logged 2026-11-02 20:14 UTC in Let's Encrypt Willow2027h1, entry 901,602,892
    SHA-256 6327cb79af4629ec1c775af6e93a0e4963a96301ff3cf0f8f61668ddc3065b31
    Public key SHA-256 bf38c18b083e4f61b7a1d19b3c6549754f3973f1597c266d4d188652d0be7f6a
    Brand
    Hyperliquid
    Addresses
    31.220.1.30 · Seychelles · AS206264 AMARUTU-TECHNOLOGY Amarutu Technology Ltd
    Domain
    hyperliquid-eth.com
    Registered
    2026-10-19 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 00:33 UTC

    Suggest a correction

  49. hyperliquid-btc.com SC · AS206264 · AMARUTU-TECHNOLOGY Amarutu …
    ListedPhishing hostListed by MetaMask · Address hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 17 d ago
    DetailsHide
    Hostname
    hyperliquid-btc.com
    First seen
    2026-10-27 21:00 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 08:59 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 31.220.1.30.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 31.220.1.30
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-10-27 19:58 UTC to 2027-01-25 19:58 UTC
    Logged 2026-10-27 20:56 UTC in Google PlumbersArms2027h1, entry 478,178,899
    SHA-256 ca3d46be3e9bc2badd8a06d6941d33ebcab06045a590741481b12dd0a94a1150
    Public key SHA-256 6b7c29048e15f489849804503fc5168f2fedee6ba413ebd35f8eb45d00f51bdf
    Certificate
    Issued by YR1
    Valid 2026-11-02 19:16 UTC to 2027-01-31 19:16 UTC
    Logged 2026-11-02 20:14 UTC in IPng Networks Halloumi2027h1, entry 341,297,545
    SHA-256 5bbe6eab752ba2085499d7f6464fcdf5ab1c8cf4634dd8d6ba27b81a9d48f232
    Public key SHA-256 6bed78063f4f1961fc5d64a742f798f6936b1ccfeb4c8d51a7be1588eab257b4
    Brand
    Hyperliquid
    Addresses
    31.220.1.30 · Seychelles · AS206264 AMARUTU-TECHNOLOGY Amarutu Technology Ltd
    Domain
    hyperliquid-btc.com
    Registered
    2026-10-19 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 00:33 UTC

    Suggest a correction

  50. www.eng-hyperliquid.org SC · AS206264 · AMARUTU-TECHNOLOGY Amarutu …
    ListedPhishing hostUnder eng-hyperliquid.org, listed by MetaMask · Address hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 17 d ago
    DetailsHide
    Hostname
    www.eng-hyperliquid.org
    First seen
    2026-10-27 16:11 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 09:04 UTC
    Listed
    MetaMask, listing eng-hyperliquid.org and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 31.220.1.30.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 31.220.1.30
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-10-27 15:09 UTC to 2027-01-25 15:09 UTC
    Logged 2026-10-27 16:08 UTC in Google PlumbersArms2027h1, entry 474,603,270
    SHA-256 0aedbfc25aa33f2296a6bd4cd2906989e2ceecbea38b9bedf5c8d31ac11466eb
    Public key SHA-256 cdb3a1a931fd698502444c9c63127e5be228d8528645f9212e5fb669e27140f4
    Certificate
    Issued by YR2
    Valid 2026-11-02 19:14 UTC to 2027-01-31 19:14 UTC
    Logged 2026-11-02 20:12 UTC in Google PlumbersArms2027h1, entry 578,245,587
    SHA-256 9846c570a6bf6e61f727a3d7cd472c9382002b84797972ad25c9d10fcd28b9b2
    Public key SHA-256 309aa857b5866ca1edc0b8c3c9f1531d6cda1502b557d351e55c6235c9b3f91a
    Brand
    Hyperliquid
    Addresses
    31.220.1.30 · Seychelles · AS206264 AMARUTU-TECHNOLOGY Amarutu Technology Ltd
    Domain
    eng-hyperliquid.org
    Registered
    2026-10-19 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 00:19 UTC

    Suggest a correction

  51. eng-hyperliquid.org SC · AS206264 · AMARUTU-TECHNOLOGY Amarutu …
    ListedPhishing hostListed by MetaMask · Address hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 17 d ago
    DetailsHide
    Hostname
    eng-hyperliquid.org
    First seen
    2026-10-27 16:11 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 09:00 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 31.220.1.30.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 31.220.1.30
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-10-27 15:09 UTC to 2027-01-25 15:09 UTC
    Logged 2026-10-27 16:08 UTC in Google PlumbersArms2027h1, entry 474,603,270
    SHA-256 0aedbfc25aa33f2296a6bd4cd2906989e2ceecbea38b9bedf5c8d31ac11466eb
    Public key SHA-256 cdb3a1a931fd698502444c9c63127e5be228d8528645f9212e5fb669e27140f4
    Certificate
    Issued by YR2
    Valid 2026-11-02 19:14 UTC to 2027-01-31 19:14 UTC
    Logged 2026-11-02 20:12 UTC in Google PlumbersArms2027h1, entry 578,245,587
    SHA-256 9846c570a6bf6e61f727a3d7cd472c9382002b84797972ad25c9d10fcd28b9b2
    Public key SHA-256 309aa857b5866ca1edc0b8c3c9f1531d6cda1502b557d351e55c6235c9b3f91a
    Brand
    Hyperliquid
    Addresses
    31.220.1.30 · Seychelles · AS206264 AMARUTU-TECHNOLOGY Amarutu Technology Ltd
    Domain
    eng-hyperliquid.org
    Registered
    2026-10-19 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 00:19 UTC

    Suggest a correction

  52. v3-hyperliquid.pages.dev US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    v3-hyperliquid.pages.dev
    First seen
    2026-10-27 05:37 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 09:02 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. We matched the new listing
    3. Certificate logged in CT
    4. Latest DNS check
    Certificate
    Issued by Sectigo Public Server Authentication CA DV E36 · precertificate
    Valid 2026-10-28 00:00 UTC to 2027-01-25 15:18 UTC
    Logged 2026-10-28 03:01 UTC in IPng Networks Gouda2027h1, entry 243,808,205
    SHA-256 4edda9d1e2c38bb46b7551fb4594b87a5c803f8630236a51fa4adca76007273b
    Public key SHA-256 8b64f3e906f936007b53969c0d664ebaf4c478b019c25d46babf64b1feac6135
    Brand
    Hyperliquid
    Addresses
    172.66.44.201 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.55 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:310c::ac42:2cc9
    2606:4700:310c::ac42:2f37
    Cloudflare
    Cloudflare (172.66.44.201, 172.66.47.55): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  53. hyperliquid.mba US · AS13335 · Cloudflare, Inc.4 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 12 mo ago
    DetailsHide
    Hostname
    hyperliquid.mba
    First seen
    2026-10-26 22:57 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 08:59 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. We matched its certificate name
    3. Latest DNS check
    Certificate
    Logged in IPng Networks Gouda2027h1, entry 233,967,365
    SHA-256 10d3562205e30b07d782284aa4a5c20160b37a705c4a0d6331d442ebe0a6204f
    PhishDestroy
    Brand
    Hyperliquid
    Addresses
    104.21.15.27 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.161.16 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3032::ac43:a110
    2606:4700:3037::6815:f1b
    Cloudflare
    Cloudflare (104.21.15.27, 172.67.161.16): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    hyperliquid.mba
    Registered
    2025-11-05 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:25 UTC

    Suggest a correction

  54. hyperliquid.chrisling.dev US · AS16509 · Amazon.com, Inc.2 addresses
    ReportedAmazon Web ServicesReported by PhishDestroyMX presentSPF ~allDMARC missingRegistered 6 y ago
    DetailsHide
    Hostname
    hyperliquid.chrisling.dev
    First seen
    2026-10-26 20:16 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 00:26 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. We matched its certificate name
    3. Latest DNS check
    Certificate
    Logged in Google ParcelYard2027h1, entry 460,129,661
    SHA-256 3da520368dd967a4591dbd7e810a753cd803f317f48a429f8b200772ad2b415b
    PhishDestroy
    Brand
    Hyperliquid
    Addresses
    66.33.60.67 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    76.76.21.98 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    Amazon Web Services
    Amazon Web Services (66.33.60.67, 76.76.21.98): a cloud provider. It rents servers and addresses to its customers.
    Domain
    chrisling.dev
    Registered
    2021-04-19 · GoDaddy.com, LLC
    MX
    Receives mail at mx.zoho.com, mx2.zoho.com, mx3.zoho.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:24 UTC

    Suggest a correction

  55. claims-hyperliquid.org US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 12 mo ago
    DetailsHide
    Hostname
    claims-hyperliquid.org
    First seen
    2026-10-26 08:36 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 08:59 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. We matched its certificate name
    3. Latest DNS check
    Certificate
    Logged in DigiCert Wyvern2027h1, entry 314,236,327
    SHA-256 67393189611854ed183ac9081e413c5c324836403cec8275078a4aeb32de4b7b
    PhishDestroy
    Brand
    Hyperliquid
    Addresses
    104.21.16.205 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.215.234 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.16.205, 172.67.215.234): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    claims-hyperliquid.org
    Registered
    2025-11-04 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:23 UTC

    Suggest a correction

How certificate findings are selected

Reported: PhishTank or PhishDestroy reports the hostname as phishing. Listed: CERT Polska, MetaMask, USOM, MODA, NPA 165, JPCERT/CC, the AMF, the FSMA or BaFin lists it, in the source's own category. Phishing host: the name resolves to an address on DomainSpoof's phishing-host list, the addresses that hosted confirmed phishing in the last 48 hours. Spamhaus DROP: it resolves to an address on the Spamhaus DROP list. Same certificate: it shares a certificate with a finding and has listing evidence of its own, a report or listing by a source or its own Spamhaus DROP address.

DomainSpoof reads public certificate logs and the feeds on Sources every hour. A hostname matches Hyperliquid when a label carries the brand's name, by the rules on How it works. A lookalike spelling of an official domain matches too. A hostname with two kinds of finding is one row. Details shows the recorded checks, the source's claim and the check times available. How it works · Sources

More brands in Crypto & web3

All brands →