DNS/CDN/frontend hash drift

Evidence summary #

hyperliquid.xyz is the official frontend domain, served via Cloudflare. No confirmed DNS/CDN compromise at the official domain during the assessment period. HOWEVER: documented fake Google Ads campaigns leading to wallet-draining scams (claim-hyperliquid[.]xyz, hyperliquid[.]life) are confirmed in 2024-2025 (Phemex reporting). These are impersonator domains, not DNS drift on the official domain — RD-F-161 is the correct signal for impersonators. The fake Google Ads ecosystem elevates risk but does not trigger RD-F-105 (official domain drift) directly. Signal baseline not established; if monitoring were live, the fake ad campaigns constitute an elevated-risk context requiring establishment of a hash baseline. Score yellow due to active impersonation ecosystem creating persistent attack surface, even though the official domain itself has not been compromised.

Sources #

Methodology #

Detect whether the hash of production frontend JS changes versus the prior published hash, or a DNS config change is detected.

See the full factor methodology and distribution across all protocols →