363[.]k44os4c4wcwk0gwo0ckwccww[.]162[.]55[.]81[.]185[.]sslip[.]io

The domain 363.k44os4c4wcwk0gwo0ckwccww.162.55.81.185.sslip.io is a confirmed phishing site engaged in brand impersonation targeting Hyperliquid, a cryptocurrency platform. It poses an elevated risk as a cryptocurrency scam, falsely presenting itself as a bridging service for BTC to Ethereum, Arbitrum, Base, and Hyperliquid. The site has been taken offline, but it previously operated to deceive users into interacting with fraudulent crypto transactions or disclosing sensitive information.

Technical analysis reveals that 363.k44os4c4wcwk0gwo0ckwccww.162.55.81.185.sslip.io was flagged by 1 of 95 VirusTotal security vendors, including Ermes, and appeared on 1 security blocklist (PhishDestroy). The domain was registered through NameCheap, Inc. on February 21, 2026, and resolved to the IP address 162.55.81.185, hosted by Hetzner Online GmbH in Germany. No SSL certificate was observed, and the page title displayed was 'Bridge BTC to Ethereum, Arbitrum, Base, Hyperliquid | Garden'. The nameservers associated with the domain were ns-ovh.sslip.io, ns-hetzner.sslip.io, and ns-do-sg.sslip.io.

Users who interacted with 363.k44os4c4wcwk0gwo0ckwccww.162.55.81.185.sslip.io should immediately revoke any token approvals granted to unknown contracts and transfer remaining funds to a new wallet. If credentials were entered, change passwords for all related accounts and enable two-factor authentication. Report the phishing domain to platforms like Google Safe Browsing, PhishTank, or the impersonated brand (Hyperliquid) to assist in takedown efforts and prevent further victimization.