hyper-portfolios[.]xyz

The domain hyper-portfolios.xyz is an active generic phishing site designed to deceive users into disclosing sensitive information. It does not impersonate a specific brand or deploy a known crypto drainer kit, but its content mimics a portfolio tracking service, increasing the risk of credential theft or financial fraud. As of the latest verification, the site remains operational, posing an elevated threat to visitors searching for legitimate financial tools.

Technical indicators confirm the suspicious nature of hyper-portfolios.xyz. The domain is flagged by 3 of 95 VirusTotal security vendors, including Fortinet, Gridinsoft, and SOCRadar, and appears on 1 security blocklist (PhishDestroy). Registered through NiceNIC International Group Co., Limited on February 21, 2026, it resolves to the IP address 104.21.85.100, hosted on Cloudflare's infrastructure (AS13335). The SSL certificate is issued by Google Trust Services (WE1), and the observed page title is 'Hyperliquid | Portfolio Tracker'. Gridinsoft assigns it a trust score of 0/100, and the site employs technologies such as Node.js, Express, and HSTS, returning an HTTP 403 status.

Users who interacted with hyper-portfolios.xyz should immediately change any exposed credentials, enable two-factor authentication on all accounts, and monitor for unauthorized transactions or identity theft. Avoid entering any personal or financial details on the site. Report the domain to Google Safe Browsing, the registrar (NiceNIC), and platforms like PhishTank or the Anti-Phishing Working Group to aid in takedown efforts. If crypto wallet interactions occurred, revoke token approvals and transfer funds to a new wallet as a precaution.