hyperliquid[.]xyz-check-walelt-v3[.]com

hyperliquid.xyz-check-walelt-v3.com is a newly registered domain created on February 21, 2026 and currently resolves to the IP address 172.67.133.91. The IP belongs to the Cloudflare network (AS13335) and is geolocated to the United States. Registration was performed through GMO Internet Group, Inc. d/b/a Onamae.com, and the authoritative nameservers are ns1.verification-hold.suspended-domain.com and ns2.verification-hold.suspended-domain.com. Technical profiling shows the domain is listed on two public blocklists, PhishDestroy and ScamSniffer, and receives a Gridinsoft trust score of 0 out of 100. VirusTotal analysis has flagged the domain by 10 of 95 security vendors. An HTTP request returns a 403 status code and the site presents no SSL certificate, indicating a lack of transport encryption. These indicators collectively suggest a malicious infrastructure designed to avoid detection while serving malicious content. The site claims to impersonate the cryptocurrency platform Hyperliquid, as indicated by the page title hyperliquid.xyz-check-walelt-v3.com and the brand target field. The scam type is classified as cryptocurrency, placing it in the high‑risk category for brand‑impersonation attacks. While the exact payload or credential‑capture mechanisms have not been publicly disclosed, the presence of a brand‑specific domain and the rapid registration timeline are consistent with credential‑harvesting campaigns targeting Hyperliquid users. Defenders should add the domain and its resolving IP to outbound and inbound deny lists, and ensure that any DNS filtering solutions block queries to the associated nameservers. Continuous monitoring of Cloudflare‑hosted IP ranges for new registrations resembling the observed pattern is advised. Incident response teams should also watch for related indicators such as the same nameserver pattern or similar sub‑domain structures in future threat feeds. The high risk rating warrants immediate containment measures.