airdrop-hyperliquids[.]org

This domain is flagged as a brand impersonation threat specifically targeting Hyperliquid, a decentralized perpetuals exchange. Analysis indicates the domain was designed to mimic legitimate Hyperliquid airdrop campaigns, likely to deceive users into connecting wallets or submitting sensitive credentials under false pretenses. The intent appears to be crypto asset theft through social engineering, exploiting trust in Hyperliquid’s brand to facilitate unauthorized transactions or account takeovers. Infrastructure analysis reveals the domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, and resolved to IP address 172.67.133.241. At the time of assessment, the domain showed 0 detections across 95 security engines on VirusTotal, though it appeared on one security blocklist. The page title 'Just a moment...' suggests Cloudflare protection or a placeholder page, while the SSL certificate issued by Google Trust Services and detected technologies (HSTS, Cloudflare Browser Insights, HTTP/3) indicate an attempt to appear legitimate. Users who visited airdrop-hyperliquids.org should assume potential exposure to credential theft or wallet-draining attempts. Immediate actions include revoking any connected wallet permissions, monitoring transaction histories for unauthorized activity, and rotating passwords or private keys associated with Hyperliquid or related services. If sensitive data was submitted, affected accounts should be secured, and any suspicious transactions reported to the platform’s official support channels. Given the domain’s current offline status, further monitoring of Hyperliquid-related communications is advised to avoid similar threats.