hyperliquids[.]world

The domain hyperliquids.world was registered on February 21, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and is currently listed as offline. Technical analysis shows the domain resolves to the IP address 188.114.96.3, which is part of the Cloudflare, Inc. network (AS13335) and geolocated to the United States. No SSL certificate is presented for the site, indicating that transport‑layer encryption was not employed when the domain was active. The page title observed during prior capture reads "Hyperliquid Airdrop Portal | Claim Hyperliquid Tokens | Hyperliquid Crypto Trading," directly referencing the Hyperliquid brand and suggesting an airdrop‑based cryptocurrency scam.

The campaign is associated with an "Airdrop Scam" phishing kit, a known template used to lure victims into submitting wallet credentials or private keys. Detection evidence shows the domain appears on four independent blocklists—PhishDestroy, MetaMask, ScamSniffer, and SEAL—demonstrating that multiple threat‑intel feeds have flagged the host. AlienVault OTX includes the domain in one threat‑intelligence pulse, and VirusTotal reports six of ninety‑five scanning engines flagging the domain as malicious, reinforcing the suspicion of malicious intent. The elevated risk rating reflects the combination of brand impersonation, lack of encryption, and corroborating detection data.

Uncertainties remain regarding the exact scope of victim outreach, the presence of additional infrastructure, and whether any residual content persists after takedown. Defenders should continue to block hyperliquids.world at network perimeter controls, update URL filtering policies with the identified blocklist identifiers, and monitor for any re‑registration attempts of similar domains. Incident response teams should also advise users of Hyperliquid to disregard unsolicited airdrop offers originating from this domain and to verify official communications through recognized Hyperliquid channels.