hyperbolictoken[.]xyz

The domain hyperbolictoken.xyz was registered on October 19, 2025 through the registrar Ultahost, Inc. It resolves to the IPv4 address 45.12.2.67, which is assigned to AS6698 Virtual Systems LLC and geolocated to Ukraine. The site employed a Let's Encrypt R12 certificate, indicating that TLS was active at the time of observation. DNS resolution was provided by authoritative nameservers ns1.hyperbolictoken.xyz and ns2.hyperbolictoken.xyz, both hosted on the same infrastructure. Automated analysis identified the web stack as Plesk front‑ended by Nginx and styled with Tailwind CSS.

The page title returned by the HTTP response was "Hyperbolic - Open Access AI Cloud | Presale & Airdrop," consistent with a cryptocurrency presale or airdrop narrative. The campaign was classified as a crypto scam and linked to an "Airdrop Scam" phishing kit, specifically targeting MetaMask users. VirusTotal scans recorded three positive detections out of ninety‑five vendors, and the domain appears on a single external security blocklist. Additional reputation data include a Gridinsoft trust score of 0 out of 100 and a blocklisting by PhishDestroy.

The domain is currently offline, suggesting that the operators have withdrawn the site or that takedown actions have been effective. While the available evidence confirms the infrastructure, hosting details, and the targeted brand, no content‑level analysis of the landing page is available beyond the title. Defenders should continue to monitor the associated IP address and ASN for any re‑use, update web filtering and endpoint protection rules to flag the domain and its IP, and consider adding the domain to internal blocklists. Threat intelligence sharing with partners is recommended to ensure broader awareness of the Airdrop Scam kit that leverages the MetaMask brand.