Is hyperliquid-perps.com a scam? TrustSniffer's high-risk assessment: 1/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website presents itself as a perpetual-futures decentralised exchange on the HyperEVM network. Its homepage title advertises "#1 Perpetuals DEX on HyperEVM" and trading with 50x leverage. Its apparent purpose is to draw visitors into leveraged crypto-derivatives trading under a name that echoes a well-known perpetuals protocol. A full page of marketing text was captured, but nothing on it independently ties the site to a real-world operator.

Scam/Impersonation Risk

The site carries a confirmed blacklist signal, which is the decisive contradiction in this assessment. Several major security vendors currently classify the domain as malicious, and an external blacklist feed also lists it. That detection level is consistent with phishing or malware-distribution use. The domain name pairs a recognised protocol brand with the generic word "perps", and the title claims category leadership ("#1") without support. No evidence in the record links the site to the protocol it resembles, so the pattern fits a lookalike or brand-borrowing site. The registration is only a few months old and has almost no independent history, so no track record offsets the detections. Some observations are neutral or mildly favourable. In automated sessions the page loaded stably, made no external data transfers, and showed no wallet-draining routines, clipboard tampering, hidden forms or cloaking. These behaviours do not outweigh the blacklist signal. A malicious page can be quiet in a sandbox, and a trading front end would typically turn hostile only once a wallet is connected. No conflicting legal entities were observed on the site's identity pages. Evidence:

• Homepage: the title promises a "#1 Perpetuals DEX on HyperEVM" with 50x leverage. The superlative is unsupported, and the name resembles an established protocol.
• Domain provenance: registered 2026-06-01 (~0.4 years old). The web archive holds 1 snapshot, captured 2026-07-08, so the tracked history is 1 year at most.
• Reputation: 15 malicious and 2 suspicious verdicts from the security-vendor aggregation, including major endpoint-security vendors, plus a listing on an external blacklist.
• Behavioural sandbox (homepage): 3 of 3 runs succeeded with stable HTTP 200 responses and zero external requests, with no drainer, clipboard or cloaking behaviour. This is consistent with a static or pre-activation page.

Regulatory Verification Notes

The site gives no clear disclosure of a legal entity, regulator or licence on the pages captured. That omission matters for a service offering high-leverage derivatives, a product category that is regulated or restricted in many jurisdictions. It is a verification gap rather than proof of misconduct, and it is assessed here alongside the independent blacklist signal. No third-party broker-reputation record matches the domain, so there is no broker-side reputational context. The domain is also not recognised in the DeFi protocol directories consulted, which means no verified link to the protocol it appears to reference. The site's transport encryption is valid, but it is a basic domain-validated certificate. It confirms an encrypted connection and says nothing about who operates the site. Evidence:

• Hosting: served from AS59692 (IQWEB – IQWeb FZ-LLC, UAE); the domain is registered through Gname.com Pte. Ltd.
• Transport security: TLS certificate issued by YR2 at domain-validation level, valid to 2026-11-22 (26 days remaining at assessment).
• DeFi recognition: the domain is not listed in the DeFi protocol directory, so no TVL or market-cap figure exists to corroborate its claims.
• Homepage: no named operator, licence or registration number was identified in the captured content.

What to Verify Next

Anyone who believes they have a genuine reason to use this service should treat it as unauthenticated until proven otherwise. The official protocol's address should be obtained from an independent route, such as its published documentation, verified social accounts or a reputable ecosystem directory, and compared with this domain. Any claim of affiliation, and any licence or registration claim for leveraged trading, should be checked against the relevant public registry. Support and contact channels should be confirmed through the official protocol, not through links on this site. A user who has already connected a wallet or entered credentials here should revoke token approvals and move assets to a fresh wallet. Evidence:

• Homepage: the "#1" and 50x leverage claims have no on-site substantiation to check against.
• Reputation: the current malicious classifications mean no part of the site has been independently cleared.
• Domain provenance: a registration under six months old with a single archive capture offers no history to confirm continuity with any established brand.

Summary Verdict

The posture is clearly adverse and high-risk. A confirmed blacklist listing, a very young and thinly documented domain, and brand-adjacent positioning together outweigh the benign technical signals. Identity remains unestablished, and the site cannot be treated as a legitimate counterpart for any sensitive or financial interaction.

Infrastructure Integrity

The site sits on a single directly exposed address at a UAE-based hosting provider. No CDN or WAF fronts it, so there is no protective layer to mitigate exposure. The hosting network is a general-purpose data-centre and web-hosting provider. Six abuse reports have been filed against that address, and they are attributed to shared provider infrastructure and are not discounted. A heuristic flag also notes a mismatch between the network's registry and its country; it is unconfirmed and carries little weight. Nothing in the infrastructure offsets the reputation risk.

Closing Assessment

The site should be limited to passive, read-only viewing at most, ideally from an isolated browser. No wallet should be connected, no credentials entered, no funds or tokens sent, and nothing downloaded from it. Access to the official protocol should be through independently sourced channels only.

Signals weighed against the site

• AbuseIPDB: 6 reports on hosting IP 186.2.175.35 (IQWeb FZ-LLC, Data Center/Web Hosting/Transit), 11% confidence. The reports are attributed to shared infrastructure, not specifically to this website.