hyperliquid[.]promo

The domain hyperliquid.promo has been identified as a brand impersonation threat specializing in airdrop scams, currently marked as offline. This domain was designed to deceive users by mimicking legitimate token distribution events, specifically targeting cryptocurrency participants under the guise of offering free token allocations. The page title, 'Token Airdrops | Upheaval,' further reinforces the fraudulent intent by leveraging terminology commonly associated with cryptocurrency promotions to lure victims into disclosing sensitive information or transferring assets. Analysis of the domain infrastructure reveals multiple indicators of malicious activity. The domain was registered on February 21, 2026, through NameCheap, Inc., a registrar frequently utilized in phishing and fraudulent schemes. It resolves to the IP address 107.173.159.82, hosted under AS36352 (HostPapa) in the United States. Security vendor assessments indicate that 11 of 95 engines on VirusTotal have flagged the domain as malicious. Additionally, the domain appears on one security blocklist, specifically PhishDestroy, and utilizes a Let's Encrypt SSL certificate (R12), which, while providing encryption, does not validate the legitimacy of the underlying content. The combination of a recently registered domain, low detection thresholds, and association with known fraudulent patterns underscores the elevated risk posed by this infrastructure. As of the latest assessment, hyperliquid.promo has been taken offline, reducing immediate exposure to potential victims. However, the domain's infrastructure and registration details remain relevant for historical and forensic analysis. Organizations and individuals are advised to block access to the domain and its associated IP address (107.173.159.82) at the network level. Users should exercise caution when encountering unsolicited airdrop promotions, particularly those requiring wallet connections or personal information. Monitoring for similar domains registered through NameCheap or resolving to the same IP range may help preemptively identify related threats. Security teams are encouraged to update detection rules to include this domain and its indicators of compromise in threat intelligence feeds.