nfts-hyperliquld[.]xyz

This domain, nfts-hyperliquld.xyz, poses a direct financial threat to cryptocurrency users by impersonating the Hyperliquid trading platform. Analysis indicates the site is designed to execute crypto drainer attacks, where malicious scripts automatically siphon funds from connected wallets without user consent. The page title, 46.430 | HYPE/USDT | Hyperliquid, mimics legitimate trading interfaces to deceive victims into interacting with the fraudulent platform, likely leading to irreversible asset loss. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on September 29, 2025, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains. VirusTotal detection metrics show 10 out of 95 security vendors flagging the domain as malicious, while it appears on two independent security blocklists. The site previously resolved to the IP address 188.114.97.3, a hosting provider commonly used by threat actors to obscure infrastructure ownership. These technical artifacts confirm the domain's fraudulent nature and its role in targeted phishing operations. Users who visited nfts-hyperliquld.xyz should take immediate action to mitigate potential damage. First, disconnect any wallets connected to the site and revoke all active permissions using a blockchain explorer or wallet management tool. Scan the device for malware using updated security software, as phishing sites often deploy secondary payloads. Monitor all linked accounts for unauthorized transactions and consider transferring assets to a new wallet if suspicious activity is detected. Report the incident to relevant platforms and security teams to help prevent further exploitation. Given the domain's elevated risk level and confirmed crypto drainer functionality, prompt response is critical to limiting financial exposure.