hyperliquid-airdrop-faq[.]pages[.]dev

This domain, hyperliquid-airdrop-faq.pages.dev, operates as a fraudulent airdrop portal designed to deceive cryptocurrency users into connecting wallets to malicious smart contracts. The site impersonates the legitimate Hyperliquid protocol by offering a fabricated $HYPE token distribution, a common tactic in crypto drainer schemes. Analysis of the page title, 'Hyperliquid Airdrop FAQ — Earn Points & Claim $HYPE,' confirms the intent to exploit user trust in token giveaways, which often lead to unauthorized asset transfers or wallet compromises.

Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered through Cloudflare Pages on March 28, 2026, and resolves to the IP address 172.66.44.128, geolocated to Cloudflare’s infrastructure in California. Security vendors on VirusTotal flag the domain at a ratio of 6/95, while PhishDestroy has explicitly blocked it. The SSL certificate, issued by Google Trust Services (WE1), provides no legitimacy, as scam operators frequently abuse free certificate authorities to create a false sense of security. The domain appears on at least one security blocklist, further corroborating its malicious classification.

Users who visited hyperliquid-airdrop-faq.pages.dev and interacted with the site—particularly those who connected wallets or approved transactions—should assume potential compromise. Immediate actions include revoking all recent smart contract approvals via a blockchain explorer, transferring assets to a new wallet, and monitoring connected accounts for unauthorized activity. The domain remains active as of this report, and users are advised to treat any communication or links referencing Hyperliquid airdrops as fraudulent unless verified through official project channels.