airdrop-hyperliquid[.]com

PhishDestroy identifies airdrop-hyperliquid.com as an active brand impersonation threat targeting Hyperliquid users, currently under investigation but flagged across multiple security platforms. This domain mimics Hyperliquid’s branding to deceive victims into connecting crypto wallets or sharing credentials, with threat actors leveraging airdrop-themed lures to facilitate fund drainage. The scam remains undetected by traditional antivirus tools but has been preemptively blocked by Polkadot, Codeesura, Enkrypt, and ScamSniffer, indicating early-stage compromise awareness. This domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on January 27, 2026, and resolves to IP 188.114.97.3. Security telemetry shows 0 detections on VirusTotal out of 95 engines, alongside its presence on 4 blocklists. While the SSL certificate is issued by Google Trust Services—a legitimate provider—the domain’s recent creation and lack of detections suggest evasive tactics to bypass initial scans. The impersonation of Hyperliquid, a prominent decentralized exchange, amplifies the risk as attackers exploit brand recognition to amplify deception. To mitigate exposure, users should avoid interacting with airdrop-hyperliquid.com and verify Hyperliquid’s official domains (hyperliquid.xyz) via their official channels. Block the domain at the network level using the IP (188.114.97.3) and domain (airdroop-hyperliquid.com) across endpoints and DNS filters. Report the domain to security vendors and Hyperliquid’s support team to accelerate takedown efforts. Enable wallet approval alerts and revoke suspicious permissions via tools like Revoke.cash to prevent unauthorized transactions.