# airdrop-hyperliquid.com — SUSPICIOUS

> airdroop-hyperliquid.com poses as Hyperliquid in a brand impersonation scam, with 0/95 VirusTotal detections. Investigate now to prevent asset loss.

## Summary
PhishDestroy identifies airdrop-hyperliquid.com as an active brand impersonation threat targeting Hyperliquid users, currently under investigation but flagged across multiple security platforms. This domain mimics Hyperliquid’s branding to deceive victims into connecting crypto wallets or sharing credentials, with threat actors leveraging airdrop-themed lures to facilitate fund drainage. The scam remains undetected by traditional antivirus tools but has been preemptively blocked by Polkadot, Codeesura, Enkrypt, and ScamSniffer, indicating early-stage compromise awareness.  This domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on January 27, 2026, and resolves to IP 188.114.97.3. Security telemetry shows 0 detections on VirusTotal out of 95 engines, alongside its presence on 4 blocklists. While the SSL certificate is issued by Google Trust Services—a legitimate provider—the domain’s recent creation and lack of detections suggest evasive tactics to bypass initial scans. The impersonation of Hyperliquid, a prominent decentralized exchange, amplifies the risk as attackers exploit brand recognition to amplify deception.  To mitigate exposure, users should avoid interacting with airdrop-hyperliquid.com and verify Hyperliquid’s official domains (hyperliquid.xyz) via their official channels. Block the domain at the network level using the IP (188.114.97.3) and domain (airdroop-hyperliquid.com) across endpoints and DNS filters. Report the domain to security vendors and Hyperliquid’s support team to accelerate takedown efforts. Enable wallet approval alerts and revoke suspicious permissions via tools like Revoke.cash to prevent unauthorized transactions.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)
- Target brand: Hyperliquid

## Domain Intelligence
- Registered: 2026-01-27 09:42:23
- Registrar: NICENIC INTERNATIONAL GROUP CO., LIMITED
- IP: 188.114.97.3

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 4 hits
  Lists: ["Polkadot", "Codeesura", "Enkrypt", "ScamSniffer"]

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/aadcf60d-4026-4ffb-a120-7735a7db4a34
- PhishDestroy: https://phishdestroy.io/domain/airdrop-hyperliquid.com/
- LLM endpoint: https://phishdestroy.io/domain/airdrop-hyperliquid.com/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/airdrop-hyperliquid.com/
Last updated: 2026-03-29