Is hyperbullsol.info a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

HyperBull is a single-page cryptocurrency token promotion site for a token branded "$HBULL". Its headline slogan is "Real Revenue. Real Yield." The page presents itself as a yield-bearing digital-asset project and is built to attract visitors to token-related activity. Its business model appears to be the promotion of a speculative token, with revenue and yield claims as the main appeal.

Scam/Impersonation Risk

This is a high-risk site with confirmed contradictory signals. Several major security vendors currently flag the domain as malicious, and it is treated as blacklisted. The flags are strong enough that protective measures cannot offset them. The site is also very recently registered. Its archive footprint is a single capture, so it has no meaningful operating history to set against the adverse reputation. The slogan "Real Revenue. Real Yield." makes a financial-performance claim that nothing independent supports. Nothing in the evidence shows the token or project is recognised in any DeFi protocol directory that could corroborate a revenue claim. Behavioural testing adds to the concern. During interaction the page made a heavy volume of outbound background requests and data submissions to third-party destinations, about half of them to destinations outside the expected set. It also produced a very large number of script errors and rewrote its own page structure extensively after interaction. This pattern is consistent with a heavily scripted or unstable page. The tests did not detect wallet-draining code, clipboard manipulation, hidden forms, credential posts to external hosts, or content cloaking. These are absences of observed behaviour, not clearance, and they do not outweigh the blacklist. No conflicting legal identities and no brand impersonation were found. The risk rests on threat-intelligence detections and the profile of a newly created token-promotion site. Evidence:

• Homepage: titled as a token project ("HyperBull ($HBULL) — Real Revenue. Real Yield."). It promotes a yield and revenue narrative with no independently corroborated backing.
• Domain registration: registered 2026-07-22 through NICENIC INTERNATIONAL GROUP CO., LIMITED (~0.27 years old).
• Web archive: 1 snapshot, first and last seen 2026-07-26 (1 year tracked), so there is no prior history.
• Behavioural sandbox (3 of 3 runs completed): 24 external XHR requests and 12 external POSTs, of which 12 and 6 respectively went to non-whitelisted destinations. It logged 186 console errors and 2,136 DOM mutations after interaction.
• External reputation: 13 malicious and 2 suspicious detections, including three tier-1 security vendors; a confirmed blacklist hit.

Regulatory Verification Notes

The evidence shows no licensing or registration claim and no verifiable legal-entity disclosure for an operator offering a yield-bearing token product. The site's disclosure position could not be established with confidence, and the operator's real-world identity is unverified. This ownership opacity is a transparency limitation and is not itself an identity contradiction. A token promotion that implies yield would ordinarily be expected to name an accountable entity and any applicable regulatory standing. Nothing in the evidence supplies either. No third-party broker-review match exists for this domain, so there is no external regulatory or reputational record to lean on. The adverse threat-intelligence listings remain the dominant fact. Evidence:

• Homepage: no identifiable operating company, licence, or registration reference appears in the captured content.
• Hosting: served from AS13335 (Cloudflare, Inc., US).
• Transport encryption: TLS certificate issued by WE1 (DV, domain validation only), valid to 2026-12-18. This confirms an encrypted connection but says nothing about who operates the site.
• Broker-reputation dataset: no match for the domain.

What to Verify Next

Any interaction should be limited to passive reading until the threat listings are cleared. Before any engagement, the operator's identity and any claimed regulatory status should be confirmed directly with the relevant financial regulator's public register. The token's existence, issuer, and contract address should be checked through independent, reputable blockchain explorers and market-data sources, not through links on this site. Official social or support channels should be confirmed through routes found independently of the site, such as established news coverage or an offline contact. The "Real Revenue. Real Yield." claim should be tested against published, independently audited financial or on-chain data. The site should also be rechecked against threat-intelligence sources after any remediation claim. Evidence:

• Homepage: the revenue and yield claim carries no supporting documentation in the captured content.
• Registration record: the very recent creation date means no established operating record exists to rely on.
• External reputation: the active malicious listings must clear before any wallet or account interaction is considered.

Summary Verdict

The domain carries an elevated, clearly adverse risk posture. Active detections from multiple security vendors drive the assessment, supported by the site's newness, its lack of any verifiable operating track record, and its unstable, third-party-heavy behaviour. The current evidence does not support treating the site as legitimate, and the lack of a verified operator identity leaves nothing to offset that.

Infrastructure Integrity

The site is fronted by Cloudflare's CDN and WAF, and every observed address is an edge address, so the origin host could not be independently observed. The TLS certificate is valid and chains to a known issuer. These are only mitigating technical hygiene signals. Cloudflare's presence does not show the content is safe and can mask rapid content changes behind the edge. It cannot offset the active threat listings.

Closing Assessment

The site should not be used for logging in, connecting a wallet, submitting credentials, or any financial transaction. Visitors should avoid downloading anything from it. Read-only viewing in an isolated environment is the most that is reasonable. Organisations should consider blocking the domain pending independent clearance.