airdrop-zirodelta[.]com

Airdrop-zirodelta.com is an active phishing domain impersonating an airdrop scam. The site is flagged by 1 out of 91 VirusTotal vendors and appears on three public blocklists, including PhishDestroy, MetaMask, and SEAL. This domain is hosted on IP 188.114.97.3 in the US, under Cloudflare's infrastructure. The registrar is NICENIC INTERNATIONAL GROUP CO., LIMITED, and the SSL certificate is issued by Google Trust Services.

The domain was created on June 17, 2026, and PhishDestroy detected it two days later on June 19, 2026. The platform risk score is notably high at 88 out of 100, indicating a significant threat level. The site lures users with promises of earning Hyperliquid funding rates while maintaining control of their keys, a common tactic in airdrop scams.

Although only one vendor currently flags the domain as malicious, this low detection count underscores the freshness of the threat. Phishing domains often exploit the time gap between registration and when antivirus databases are updated. PhishDestroy's detection pipeline identifies these threats during this critical window, ensuring early awareness and mitigation. The presence of this domain on multiple blocklists further emphasizes its malicious intent.