airdropped-hyperliquid[.]xyz

This domain, airdropped-hyperliquid.xyz, is currently listed as offline but retains indicators of malicious intent. Registration records show it was created on 16 October 2025 through Web Commerce Communications Limited, a registrar often associated with short‑lived abuse domains. The authoritative nameservers are alberto.ns.cloudflare.com and teagan.ns.cloudflare.com, pointing to Cloudflare’s DNS service. Resolution yields the IP address 172.67.141.71, which belongs to AS13335 Cloudflare, Inc., located in the United States. No TLS certificate is presented, meaning the site does not serve HTTPS traffic, which is consistent with the "Just a moment..." page title captured during the last crawl.

Threat intelligence categorises the site as a crypto scam, specifically a crypto drainer. Seven of ninety‑five VirusTotal scanners have flagged the domain, suggesting the presence of known malicious patterns. It appears on a single external blocklist and is explicitly blocked by PhishDestroy, reinforcing the assessment of hostile behavior. The lack of additional public detections limits the depth of the profile, and the offline status prevents observation of active payload delivery or transaction‑stealing mechanisms. Defenders should treat the domain as high‑risk.

Immediate actions include adding the hostname to network‑level deny lists, configuring DNS sinks or firewall rules to drop traffic to 172.67.141.71, and monitoring for any resurgence of the domain on alternative IPs or new sub‑domains. Continuous observation of the associated Cloudflare nameservers is advised, as threat actors frequently repoint abused domains to fresh infrastructure. Although the site is not serving TLS, any future re‑activation could adopt HTTPS, so certificate monitoring is recommended. In summary, the combination of recent registration, Cloudflare hosting, partial vendor detections, and blocklist inclusion justifies an elevated risk rating and proactive mitigation.