# hyperliquid-airdrop.xyz — SUSPICIOUS

> hyperliquid-airdrop.xyz mimics Hyperliquid to steal data. Stay alert and avoid this phishing site. Protect yourself from fraud today.

## Summary
PhishDestroy identifies hyperliquid-airdrop.xyz as a medium-risk phishing domain impersonating the legitimate Hyperliquid brand. Classified under brand impersonation, this domain sought to deceive users by mimicking Hyperliquid’s identity, likely to harvest sensitive information.

Technical analysis reveals that hyperliquid-airdrop.xyz was registered on February 21, 2026, via NiceNIC International Group Co., Limited. The domain resolved to IP address 104.21.71.175 and displayed the page title "Just a moment...". It appeared on four security blocklists and was flagged by 4 out of 95 security vendors on VirusTotal, further confirming suspicious activity linked to credential phishing attempts.

Currently, hyperliquid-airdrop.xyz is offline, reflecting effective mitigation efforts. Users are advised to remain vigilant against similar fraudulent domains and verify URLs carefully. PhishDestroy continues monitoring such threats to protect the community from brand impersonation scams.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: dead (HTTP 403)
- Scam type: Airdrop Scam
- Target brand: Hyperliquid
- Page title: Just a moment...

## Domain Intelligence
- Registered: 2026-02-21 07:01:08
- Registrar: NiceNIC International Group Co., Limited
- Country: HK
- IP: 104.21.71.175
- IP Country: US
- IP City: San Francisco
- IP Org: AS13335 Cloudflare, Inc.
- Nameservers: ["heather.ns.cloudflare.com", "peyton.ns.cloudflare.com"]
- SSL Issuer: Google Trust Services / WE1

## Detection Status
- VirusTotal: 4 vendors flagged
  Vendors: ["Forcepoint ThreatSeeker", "Gridinsoft", "Seclookup", "SOCRadar"]
- Google Safe Browsing: clean
- Blocklists: 4 hits
  Lists: ["PhishDestroy", "Polkadot", "Enkrypt", "Codeesura"]

## Evidence
- Screenshot: https://urlscan.io/screenshots/019bad67-3e6d-7159-8f52-314d552784cc.png
- PhishDestroy: https://phishdestroy.io/domain/hyperliquid-airdrop.xyz/
- LLM endpoint: https://phishdestroy.io/domain/hyperliquid-airdrop.xyz/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/hyperliquid-airdrop.xyz/
Last updated: 2026-03-19