hyperliquid-airdrop[.]trade

The domain hyperliquid-airdrop.trade was registered on February 21, 2026 and is currently taken offline. The only visible page title is “Nur einen Moment…”, which offers no functional content. VirusTotal records show that six of ninety‑three scanning engines flagged the domain as malicious, indicating a moderate level of detection confidence. Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on a single public security blocklist. The SSL certificate is identified as WE1, suggesting a weak or self‑signed implementation.

Network resolution points to IP address 104.21.8.186, which is hosted by Cloudflare, Inc. (AS13335) and geolocated to the United States. PhishDestroy has explicitly blocked the domain, and the overall scam classification is a crypto drainer, consistent with the broader “Crypto Scam” label in the intelligence. Analysis indicates that the infrastructure relies on the Cloudflare edge network, a common choice for fast‑flux and anonymised malicious actors. The low trust score, limited blocklist presence, and modest vendor detections suggest the site may have been short‑lived or manually taken down after initial distribution. Because the domain is offline, direct payload collection is not possible, and the exact phishing kit or payload has not been recovered.

Defenders should add hyperliquid-airdrop.trade to internal URL filtering and DNS blocklists, monitor the associated IP 104.21.8.186 for any resurgence of malicious activity, and incorporate the domain’s indicator set into threat‑intel feeds. Continuous observation of Cloudflare‑hosted addresses that share the same ASN is recommended, as adversaries often recycle similar edge nodes for new campaigns. Network traffic to the domain should be denied, and any logs containing the domain name or IP should be reviewed for prior infection attempts. Updating endpoint security signatures with the six vendor detections can improve early blocking of similar crypto‑drainer campaigns.