hyperion-airdrop[.]pages[.]dev

The domain hyperion-airdrop.pages.dev was created on February 21, 2026 and is currently marked offline. Infrastructure analysis shows the domain is hosted behind Cloudflare, using the IP address 172.66.47.123, which belongs to AS13335 (Cloudflare, Inc.) in the United States. The site served over HTTPS with a Google Trust Services / WE1 certificate, employed HTTP/3 and enforced HSTS, indicating a modern web stack. The registrar information confirms registration through Cloudflare, Inc., and the authoritative nameservers are hattie.ns.cloudflare.com and peter.ns.cloudflare.com.

The HTTP response returned a 403 status code, and the page title displayed "Suspected phishing site | Cloudflare," matching the known scam type of a fake airdrop. Threat intelligence sources report that VirusTotal flagged the domain in five of ninety-three scanners, and the site appears on a single security blocklist, notably PhishDestroy. A Gridinsoft trust score of 0 out of 100 further underscores the malicious assessment. Evidence points to a crypto drainer operation that pretends to offer an airdrop, a pattern commonly used to harvest private keys or wallet credentials.

Uncertainty remains regarding the exact payload or user‑interaction mechanisms because the page content has not been captured beyond the title, and no malware samples have been released. Defenders should immediately block hyperion-airdrop.pages.dev at DNS and proxy layers, monitor for any DNS queries or TLS handshakes to the associated Cloudflare IP, and add the domain to internal threat intelligence feeds. Continuous watch of Cloudflare‑hosted subdomains that share similar naming conventions is recommended, as the infrastructure can be rapidly re‑used for new phishing campaigns.