airdrop-hype[.]fun

Analysis of the domain airdrop-hype.fun, created on October 31, 2025 and currently taken offline, indicates a high‑risk crypto‑drainer operation. The domain is registered through NiceNIC International Group Co., Limited and resolves to the IPv4 address 213.165.61.42, which belongs to AS207713 GLOBAL INTERNET SOLUTIONS LLC and is geolocated in Russia. No TLS certificate is presented, confirming the absence of HTTPS protection.

VirusTotal records show that 11 of 95 security vendors have flagged the domain as malicious, demonstrating moderate consensus among commercial scanners. The domain is listed on a single external blocklist and is explicitly blocked by the PhishDestroy service, reinforcing the view that it is being used for fraudulent activity. The only visible page title retrieved prior to takedown was “Hyperliquid,” a name that does not correspond to the targeted brand and suggests a generic lure for cryptocurrency users.

Because the site is offline, no further HTTP response codes, content hashes, or behavioral telemetry are available, leaving the full payload and victim interaction details unknown. Defenders should continue to block the IP address 213.165.61.42 at network perimeters, add airdrop-hype.fun to local and cloud‑based URL filtering policies, and monitor for any future re‑registration that may reuse the same registrar or hosting provider. Ongoing observation of the associated ASN and any emergence of new domains sharing the same name servers (a.dnspod.com, b.dnspod.com, c.dnspod.com) is also recommended to disrupt potential campaign expansion.