hyperfoundation-airdrop[.]org

The domain hyperfoundation-airdrop.org was registered on February 21, 2026 through NiceNIC International Group Co., Limited and is currently classified as a cryptocurrency drainer. The site presents a page title of "Pieni hetki..." and returns an HTTP 403 status code, indicating that direct access is blocked for unauthenticated requests. Gridinsoft assigns it a trust score of 0 out of 100, reinforcing its malicious disposition.

Infrastructure analysis shows the domain resolves to IP address 188.114.96.3, which is hosted within the United States under ASN 13335, operated by Cloudflare, Inc. The authoritative nameservers are bella.ns.cloudflare.com and steven.ns.cloudflare.com, both belonging to the same provider. TLS termination is performed by a certificate issued by Google Trust Services under the WE1 identifier, and the service utilizes Cloudflare Browser Insights, HTTP/3, and other Cloudflare‑specific technologies.

Threat intelligence corroborates the malicious nature of the host. The domain appears on three external blocklists and has been flagged by PhishDestroy, MetaMask, and SEAL. AlienVault OTX references the domain in a single pulse, and VirusTotal reports that 7 out of 95 scanned security vendors have identified the domain as malicious. These indicators collectively suggest active exploitation aimed at draining cryptocurrency assets from unsuspecting users.

Uncertainty remains regarding the exact payload delivery mechanism and the specific cryptocurrency wallets targeted, as the public page content beyond the title has not been disclosed. Defenders should block the domain at DNS and proxy layers, monitor for outbound connections to the 188.114.96.3 address, and enforce strict controls on wallet interactions. Continuous feed updates from the listed blocklists and periodic re‑scans on VirusTotal are recommended to capture any evolution of the threat infrastructure.