inspect-hyperliquid[.]xyz

This domain, inspect-hyperliquid.xyz, was registered on 21 February 2026 through NiceNIC International Group Co., Limited and is hosted on Cloudflare infrastructure (AS13335) with the IP address 188.114.97.3 located in the United States. The domain resolves to this IP and provides no TLS certificate, indicating HTTP‑only access. The page title returned by the server is “H​y​per​li​qui​d | Por​tfol​io Tr​ack​er”, which contains the word “hyperliquid” and a portfolio tracker label but does not reveal any additional content. Intelligence links the site to a Wallet Connect Abuse kit, classifying the activity as wallet/seed phishing aimed at the Ethereum ecosystem.

The domain is listed on four independent blocklists – PhishDestroy, MetaMask, ScamSniffer, and SEAL – and the Gridinsoft trust score is 0 out of 100, reflecting a high confidence in malicious intent. VirusTotal analysis shows that five of ninety‑three scanning engines have flagged the domain, reinforcing the suspicion. No SSL certificate is present, which further reduces trustworthiness and may facilitate credential interception. The observable evidence confirms that the infrastructure is deliberately leveraged to impersonate Ethereum‑related services, likely to harvest wallet seeds or private keys via the Wallet Connect flow.

However, the exact content served at the URL has not been captured, and the site’s current offline status prevents direct verification of the phishing page layout. Defenders should continue to block the domain at network perimeter and DNS filtering layers, monitor for any resurgence, and add the IP address 188.114.97.3 to deny‑list rules. Threat‑intel teams should also correlate any Wallet Connect traffic originating from client endpoints with this host, and consider updating endpoint detection signatures to include the observed page‑title pattern. Ongoing observation of the associated blocklists is recommended to capture any re‑registration attempts.