hyperliquid-detects[.]xyz

This domain, hyperliquid-detects.xyz, was engineered to impersonate the Ethereum blockchain ecosystem by presenting a fraudulent portfolio tracker interface. The site specifically targeted users of decentralized finance platforms, attempting to harvest wallet credentials and private keys under the guise of a legitimate Hyperliquid service. The page title, "H​​​​y​​​per​​​li​​​​​qui​​​​​d | Por​​tfol​​io Tr​​​ack​​​er," contained obfuscated Unicode characters to evade basic text-based detection mechanisms, a common tactic in crypto-phishing campaigns. Analysis indicates the domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk infrastructure. It appears on 4 independent security blocklists and is flagged by 4 out of 95 security vendors on VirusTotal, confirming its malicious classification. Additionally, the domain resolved to the IP address 188.114.96.3 and was referenced in a single threat intelligence pulse on AlienVault OTX, further corroborating its role in coordinated phishing operations. Users who accessed hyperliquid-detects.xyz should immediately revoke any wallet permissions granted to the site, rotate private keys, and monitor connected accounts for unauthorized transactions. All credentials entered on the domain should be considered compromised. If financial assets were exposed, affected parties are advised to report the incident to relevant blockchain analytics platforms and local cybercrime authorities. Infrastructure analysis reveals the domain has since been taken offline, but related threat actors may deploy successor domains using similar naming conventions or registrar patterns.