hyper-airdrop[.]com

The domain hyper-airdrop.com has been confirmed as a brand impersonation scam targeting cryptocurrency users through a fraudulent airdrop scheme. Analysis indicates this domain specifically impersonates Hyperliquid, a platform associated with decentralized finance, by presenting a deceptive page titled 'Hyperliquid – Airdrop USDT.' The domain is currently offline, though its prior activity aligns with known tactics used to distribute crypto drainers or harvest credentials under false pretenses. Infrastructure analysis reveals the domain was registered on February 21, 2026, through NameSilo, LLC, a registrar frequently observed in phishing operations. It resolves to the IPv6 address 2606:4700:3030::6815:4d82, hosted on AS13335 (Cloudflare, Inc.), a network commonly leveraged to obfuscate malicious origins. Detection metrics indicate elevated risk, with 8 of 95 security vendors on VirusTotal flagging the domain as malicious. Additionally, the domain appears on one security blocklist, and its SSL certificate, issued by Google Trust Services (WE1), provides no inherent trust validation beyond basic encryption. The page title and purported airdrop offering are consistent with social engineering tactics designed to exploit user interest in token distributions. As of the latest assessment, hyper-airdrop.com has been taken offline, though its infrastructure and registration details remain of forensic interest. Organizations and individuals are advised to treat all interactions with this domain as malicious. Network-level blocking of the resolved IP address and associated CIDR ranges is recommended to prevent potential re-emergence. Users should verify airdrop claims exclusively through official channels and exercise caution with domains registered within the past 90 days, particularly those employing Cloudflare or similar proxy services. Monitoring for newly registered lookalike domains with similar naming conventions is strongly advised.