hyperliquidfilter[.]xyz

The domain hyperliquidfilter.xyz was registered on February 21, 2026 through NiceNIC International Group Co., Limited and is currently listed as offline. Analysis shows the domain resolves to IP address 104.21.39.156, which belongs to AS13335 Cloudflare, Inc. in the United States. No SSL certificate was observed for the host, indicating an unencrypted HTTP service. The page title returned by the server is "H​​​​y​​​per​​​​li​​​​​qui​​​​​d | Por​​tfol​​io Tr​​​ack​​​er," containing unusual zero‑width characters but otherwise offering no additional context.

The site is categorized as a wallet/seed phishing operation targeting Ethereum users, as indicated by the supplied brand target and scam type. Security telemetry reports that PhishDestroy has blocked the domain, and it appears on a single public security blocklist. VirusTotal analysis recorded detections from six of ninety‑three scanning engines, reinforcing the malicious assessment. Independent scoring from Gridinsoft assigned a trust rating of 0 out of 100, the lowest possible score, further confirming the hostile nature of the infrastructure.

Although the site is presently taken offline, defenders should continue to enforce DNS‑level blocking for hyperliquidfilter.xyz, monitor Cloudflare‑hosted IP ranges for similar patterns, and incorporate the domain into threat‑intel feeds. Additional uncertainty remains regarding the exact content served before takedown, as the offline status precludes direct observation of any credential‑capture forms or malicious payloads. Organizations should remain vigilant for any residual phishing emails or social‑engineering campaigns referencing this domain, and consider augmenting endpoint and email filters with the observed indicator set.