hyper-earning[.]top

The domain hyper-earning.top was registered on May 16, 2026 by the entity identified as 耐思尼克国际集团有限公司. It resolves to the Cloudflare‑managed address 172.67.209.104 and is served through the authoritative nameservers teagan.ns.cloudflare.com and tosana.ns.cloudflare.com. The site is protected by a Let’s Encrypt certificate chained to the E8 intermediate, indicating use of a free TLS provider. Technical fingerprinting reveals a front‑end built with React and Gatsby, supplemented by SweetAlert2, jsDelivr, cdnjs, Webpack and Cloudflare Browser Insights – a stack commonly employed for rapid deployment of malicious landing pages.

The visible page title, “How to Earn‑Hyper With Hyperliquid Airdrop in DeFi Success,” coupled with the classification of the underlying kit as an “Airdrop Scam,” demonstrates a brand‑impersonation effort targeting users of the Hyperliquid platform. Gridinsoft assigns a trust score of 0/100, and the domain appears on four security blocklists. It is currently blocked by PhishDestroy, MetaMask, ScamSniffer, and SEAL. VirusTotal analysis shows 2 of 92 scanning engines flag the domain as malicious, reinforcing the malicious intent.

The site has been taken offline at the time of reporting, so no live HTTP response or form details are available for further forensic analysis. Defenders should add hyper-earning.top to internal deny lists, monitor DNS queries for the associated IP and Cloudflare nameservers, and enforce web‑filter rules that block any traffic to this domain. Users of cryptocurrency wallets should be reminded that Hyperliquid has not issued any airdrop; any unsolicited airdrop requests should be treated as suspicious and reported. Continuous threat‑intel monitoring is advised to detect potential re‑hosting of the same kit under new domains.