hyper-liquidxyz[.]pages[.]dev

Analysis of hyper-liquidxyz.pages.dev indicates that the site was created on April 09, 2026 and is currently taken offline, returning an HTTP 403 status code. The domain is registered through Cloudflare, Inc. and resolves to the Cloudflare IP address 172.66.44.85, which is located in Canada. DNS resolution uses the Cloudflare nameservers alan.ns.cloudflare.com and lady.ns.cloudflare.com. The TLS certificate presented is issued by Google Trust Services under the WE1 intermediate, confirming the use of a legitimate certificate authority but not authenticating the underlying content.

The page title retrieved before takedown was "Hyperliquid l Airdrop," and the listed scam type is a fake airdrop targeting the Hyperliquid brand. Security telemetry shows that seven of ninety‑four VirusTotal scanners flagged the domain, and the site appears on three external blocklists. It is actively blocked by PhishDestroy, MetaMask, and SEAL. Independent reputation scoring from Gridinsoft assigns a trust score of zero out of one hundred, indicating a high likelihood of malicious intent.

While the available data confirms the domain’s association with an airdrop‑related brand impersonation campaign, no additional content analysis is available because the site is offline. Defenders should continue to block the domain at network perimeter and endpoint layers, monitor for any resurrection of the host, and enforce user education about unsolicited airdrop offers claiming to be from Hyperliquid. Further investigation should focus on any related domains sharing the same Cloudflare IP range or similar naming patterns to disrupt the broader campaign infrastructure.