Verdict
This assessment found strong scam indicators. Do not pay, sign in, or share personal details with this site.
hyperliqd-1288.com shows high-risk / scam indicators.
| What this site appears to be | Trading interface for the Hyperliquid decentralized perpetuals exchange showing the HYPE-USDC market at about 79.22, with an order book, recent trades, a leveraged order form, account balance panels and wallet-connect options. The page contains no fixed-return promises, no seed-phrase requests and no login form. Audit and legal-entity information is not visible in the captured text. |
|---|
Evidence status and limitations
Evidence completeness: Not recorded
- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.
At a glance
The checks that decide most of this verdict.
| Malware engines | None flagged itVirusTotal | Clear |
|---|---|---|
| Google Safe Browsing | Not listedGoogle | Clear |
| Abuse reports on the host | 0% confidenceAbuseIPDB, 0 reports; shared hosting inflates reports | Clear |
| Domain age | 15 days oldMost scam domains are under a year old | Risk |
| Web archive | Archived since 20262 snapshots | Clear |
| Certificate | Encrypted connectionIssued by YE2 | Noted |
The page as captured
Key findings
- Automated classification: Sensitive Interaction Risk.
- Domain age: less than 1 year (registration continuity).
- Public web-archive history exists since 2026.
- No flags from the reputation services TrustSniffer consulted at assessment time.
Full analysis
Security Alert
Fortinet flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.
The website is a live trading interface that presents itself as the Hyperliquid decentralized perpetuals exchange. It shows the HYPE-USDC market with an order book, recent trades, a leveraged order form, account and position panels, and a wallet-connect prompt. Its apparent business model is to earn trading fees on leveraged perpetual markets, with borrowing, vaults, staking and referral features added on top.
Scam/Impersonation Risk
The site is externally blacklisted, and this is the decisive contradiction. A threat-intelligence listing is corroborated by additional suspicious classifications from other reputation sources. The page also behaved differently once a visitor interacted with it. Its content and appearance changed substantially after interaction, which is a cloaking pattern that can show one face to automated scanners and another to real users. During testing the page also sent several data submissions to external destinations that are not on any trusted list.
The page content looks like a polished trading front end. It has no seed-phrase request, no login form and no fixed-return promise. This is the typical look of a convincing replica of a known exchange, and polish is not a sign of legitimacy. The domain name is a variant of the well-known exchange name with a numeric suffix, and it was registered only days before analysis. Taken together, the evidence cannot connect this site to the genuine exchange, and the combination fits a lookalike front end. Impersonation is not confirmed by a direct brand match.
The page advertises 10x leverage on HYPE-USDC and a new USELESS-USDC perpetuals listing. It also offers borrowing of USDC and USDT against HYPE and BTC collateral, plus vaults, staking, referrals and a leaderboard. It offers wallet connection through MetaMask, WalletConnect, Trust Wallet, OKX and Coinbase. The interface displays trading fees of 0.0450% and 0.0150% and shows a 24-hour volume above $300 million and open interest above $1.6 billion. A site this new cannot substantiate these figures. A wallet-connect flow on a blacklisted, cloaking site is the main route by which a replica could request malicious signatures or token approvals. The sandbox did not observe that behavior directly. No conflicting legal entities were found, so there is no identity contradiction in the narrow sense.
- Homepage and trading page: the domain was registered on 2026-10-04 (about 0.04 years, roughly 15 days old) and is a lookalike variant of the exchange name.
- Trading page: after interaction, the content shifted strongly, with large semantic and visual differences from the initial view. This is a strong cloaking pattern, and unlisted external destinations received several outbound posts.
- Web archive: only 2 snapshots exist, both dated 2026-10-04, so there is effectively no independent history (1 year tracked).
- Trading page: the multi-wallet connect options, 10x leveraged order form and borrowing features are all presented without any visible audit or risk disclosure.
Regulatory Verification Notes
The captured pages show no legal-entity name, no licensing or registration claim, no audit reports and no risk disclosures. The operator is therefore not independently identifiable. The deterministic review leaves real-world identity unverified, and nothing on the site supports a connection to the genuine exchange. Standard Docs, Support, Terms and Privacy links are visible, but their legal content was not captured. For a leveraged derivatives and borrowing product, this absence of disclosure is material. No third-party broker or regulator record matched the site, so no external reputational signal exists on this point either way.
- Trading page: no licence, registration number, company name or audit reference appears in the captured content.
- Registration record: the domain is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED (registered 2026-10-04, expires 2027-10-04) with incomplete owner details.
- Site's hosting: served from AS13335 (Cloudflare, Inc., US).
- Transport encryption: TLS certificate issued by YE2 (DV), valid to 2027-01-02. Domain-validated encryption confirms only that traffic is encrypted, not who operates the site.
What to Verify Next
Before any engagement, confirm through the genuine exchange's officially published channels, reached independently of this site, whether this domain is an authorized interface. Wallet connection and signature requests must not be tested against this domain. If the site is to be reported, the live listing status should be rechecked with independent reputation services. The official support and contact channels should be confirmed independently, not through details shown on this site. Any claimed entity, licence or audit should be checked directly with the relevant registry or auditor.
- Homepage and trading page: the domain differs from the exchange's well-known name by a spelling change and a numeric suffix.
- Trading page: wallet-connect prompts from five wallet providers are exposed to any visitor.
- Registration record: the domain's recent registration means no established operating track record exists to check.
Summary Verdict
The available evidence places this site in a clearly high-risk posture. A confirmed blacklist listing and strong cloaking behavior outweigh the polished appearance of the interface, and nothing independent ties the site to the exchange it resembles. Positive technical signals such as working encryption and stable page delivery do not change that conclusion.
Infrastructure Integrity
The site sits behind Cloudflare's CDN and WAF. All four observed addresses are CDN edge servers, and the origin server could not be observed, so the real hosting location cannot be independently verified. This is a mitigating factor only. The protection does not offset the reputation and behavioral risks, and it can mask rapid swaps of the content served. A heuristic flag for a young domain with sparse subdomains is consistent with a newly built site, but it is unconfirmed.
Closing Assessment
The site should be treated as unsafe for any login, wallet connection, credential entry or financial transaction. At most it may be viewed without interaction. Any funds or approvals already connected to this domain should be reviewed and revoked promptly.
Written analysis generated 2026-10-19 by the TrustSniffer Analysis Engine from the evidence in this report.
What the analysis found
4 findings contributed to this verdict, raised by external reputation, hosting and network, history in the web archive, behaviour in a sandbox.
01 External reputation
- Several malware engines flagged this domain.External reputation
rule:EXT_BLACKLIST_HIGH
02 Hosting and network
- The domain was registered less than three months ago.Hosting and network
rule:DNS_NEW_DOMAIN_90D
03 History in the web archive
- The web archive has almost no record of this domain, which fits a site that is new.History in the web archive
rule:ARCH_PEN_YOUNG_AND_SPARSE
04 Behaviour in a sandbox
- The page sent data to a destination TrustSniffer does not recognise.Behaviour in a sandbox
rule:BEHAV_NONWHITELISTED_POSTS
Identity verification
| Status | UNVERIFIED |
|---|---|
| Identity score | 30/100 |
| Identity verification confidence | 50% |
- No on-site identity signals detected
Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence.
What TrustSniffer observed
First-party facts recorded during the assessment of hyperliqd-1288.com.
- The request stayed on hyperliqd-1288.com. It was not redirected to another domain. Clear
- Registration is published under NICENIC INTERNATIONAL GROUP CO., LIMITED. Clear
- DNS for this domain is served by cloudflare.com, across 2 name servers. Noted
- The registration is paid up to 2027-10-04. Noted
- The earliest public archive of this site is from 2026-10-04. Clear
- It is hosted on CLOUDFLARENET, from a server in US. Noted
Domain intelligence
| Registrar | NICENIC INTERNATIONAL GROUP CO., LIMITED |
|---|---|
| Hosting | CLOUDFLARENET - Cloudflare, Inc., US |
| Country | US |
| Server IP | 2606:4700:3037::6815:2b7b |
| Name servers | DEAN.NS.CLOUDFLARE.COM, UMA.NS.CLOUDFLARE.COM |
| CDN / edge network | Detected (cloudflare) |
| Resolved IP addresses | 4 |
| Edge IP addresses | 4 |
| Likely origin IP addresses | 0 |
| SSL issuer | YE2 |
| SSL expiry | 2027-01-02 |
| Domain age | 0.04 years (continuous registration) |
| Domain expiry | 2027-10-04 |
| Archive first seen | 2026-10-04 |
| Archive snapshots | 2 |
| Reputation | VirusTotal: 0 flagged | AbuseIPDB: 0% confidence, 0 reports | Google Safe Browsing: 0 matches |
About this assessment
A trust score summarises the evidence TrustSniffer could collect about hyperliqd-1288.com at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.
TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.