hyperliquid-airdrop[.]net

The domain hyperliquid-airdrop.net was registered on May 15 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED. Within days of creation it began serving content that matches known airdrop‑drain scams, a variant of crypto drainer activity that lures victims with promises of free tokens and then harvests private keys or wallet credentials. Infrastructure analysis shows the authoritative name servers are hera.ns.cloudflare.com and walt.ns.cloudflare.com, both operated by Cloudflare, Inc. The domain resolves to 104.21.90.224, an IP address allocated to Cloudflare’s network in Canada. HTTPS is provided by a Let’s Encrypt certificate (issuer E7) and the web server currently returns HTTP 403, indicating that direct page access is denied but the underlying service remains reachable. The Gridinsoft trust score of 0/100 further confirms a malicious reputation. Threat intelligence corroborates the malicious intent. VirusTotal reports that 5 of 95 scanned security vendors flagged the domain, and AlienVault OTX lists it in a single pulse related to crypto‑drainer campaigns. The domain appears on one public blocklist and has been specifically blocked by PhishDestroy. These indicators, combined with the airdrop scam classification, raise the risk level to high and confirm that the domain is actively being used in fraudulent operations. Defenders should block DNS resolution for hyperliquid-airdrop.net at the perimeter and enforce HTTPS inspection to capture any attempted credential submissions. Email gateways should be updated to reject links to this domain, and security information and event management (SIEM) rules should be tuned to alert on any outbound connections to the associated Cloudflare IP. Continuous monitoring of the domain’s certificate renewal and any changes to the underlying IP address is advised, as attackers may pivot to alternative Cloudflare nodes while maintaining the same malicious payload.