hyperliquids-airdrop[.]xyz

Analysis as of July 24, 2026 indicates that hyperliquids-airdrop.xyz is associated with a crypto‑drainer campaign. The domain was registered on February 21, 2026 and currently resolves to the Cloudflare‑owned address 104.21.61.9, which is advertised as being located in the United States under ASN 13335. The TLS certificate presented (identifier WE1) is valid for the host, but the low Gridinsoft trust score of 0 out of 100 suggests a high likelihood of malicious intent. VirusTotal scans show that five of ninety‑three antivirus engines flagged the domain, reinforcing the suspicion.

Independent blocklist services—including PhishDestroy, Polkadot, Enkrypt, and Codeesura—have listed the host, confirming its presence on at least four reputable blocklists. The HTTP response returns a page titled “Just a moment…”, a generic placeholder commonly used by automated redirection services, and the site status is reported as offline at the time of analysis. The evidence points to an infrastructure that leverages Cloudflare’s edge network to obscure the true origin of malicious traffic. While the exact payload or phishing pages have not been captured, the classification as a crypto‑drainer implies attempts to steal cryptocurrency wallets or private keys.

Defenders should block connections to the IP address 104.21.61.9 and add the domain to internal deny lists. Monitoring for DNS queries to hyperliquids‑airdrop.xyz and for any related certificate fingerprints is recommended. Because the site is currently offline, continuous observation is advised to detect potential re‑hosting on alternative IPs or rapid re‑registration. Organizations with exposed cryptocurrency assets should review credential hygiene and enforce multi‑factor authentication to mitigate the risk posed by this infrastructure.