hyperliquid-airdrops[.]xyz

This domain impersonates the Hyperliquid brand to facilitate brand impersonation attacks aimed at cryptocurrency users. It presents a fake airdrop interface designed to capture wallet credentials or initiate unauthorized token transfers through deceptive prompts. Infrastructure analysis reveals active redirection patterns consistent with credential theft attempts before the domain was taken offline.

Technical indicators confirm the domain hyperliquid-airdrops.xyz was registered on October 16 2025 through NiceNIC International Group Co. Limited and resolved to IP address 172.67.181.94. VirusTotal records show exactly 5 detections from 95 security vendors while the domain appeared on four distinct blocklists including Codeesura Polkadot PhishDestroy and Enkrypt. Gridinsoft assigned a trust score of 0 out of 100 and the page title matched common cloaking tactics observed in similar campaigns.

Risk assessment classifies the domain at an elevated threat level due to the combination of recent registration impersonation targeting and confirmed blocklist presence. Individuals who visited the site should immediately scan connected devices for unauthorized browser extensions or scripts review wallet transaction histories for unexpected approvals and revoke any suspicious permissions through blockchain explorers. Monitoring account activity and enabling multi-factor authentication on associated services provides additional protection against follow-on exploitation.