Is hyperliquidverify.com a scam? TrustSniffer's high-risk assessment: 2/100

Security Alert

Fortinet flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a newly registered web property whose homepage presents only a minimal page titled "FASTPANEL", with very little readable text and no clear description of an organisation, product, or service. Its domain name pairs a well-known decentralized trading platform's name with the word "verify", which suggests an account-verification or connection portal for crypto-trading users, but the site itself states no purpose or business model.

Scam/Impersonation Risk

Contradictory signals are present and decisive. Independent threat-intelligence sources currently flag the domain as malicious, with additional detections marked suspicious, and at least one major security vendor in the first tier of reputation sources is among the flaggers. The domain is therefore confirmed as blacklisted. A domain of this age combined with a "verify" naming pattern around a recognised trading brand matches a recurring credential-harvesting and wallet-phishing archetype. No conflicting legal-entity names were observed, and the sensors did not capture an explicit brand-impersonation statement on the page. The risk rests on the external detections together with the lookalike naming and the site's very recent creation. Browser-behaviour testing adds supporting context: nearly all observed network activity was directed at third-party destinations, including many outbound data submissions. The page also generated repeated script errors despite carrying almost no visible content. This pattern is consistent with a thin front end that forwards visitor interaction elsewhere. Testing detected no wallet-connection prompts, clipboard tampering, hidden forms, or content cloaking, so the specific harm mechanism remains unconfirmed. The external detections alone are enough to treat the site as hazardous for sensitive activity. Evidence:

• Homepage: the page carries only a "FASTPANEL" title and a few hundred characters of text, with no product, company, or service explanation.
• Domain registration: created in August 2026 (~0.21 years, about 77 days old), which is very recent for a site invoking an established trading brand.
• Behavioural capture of the homepage: about 27 external fetch requests and 9 external submissions, with a peak share of roughly 97.6% of traffic going to third parties, and 9 console errors across 3 runs.
• Reputation checks: 2 malicious and 2 suspicious detections from external security engines, one from a first-tier vendor.

Regulatory Verification Notes

The captured site discloses no company name, registered address, licence, regulator, or legal pages such as terms or a privacy policy, so on-site disclosure is unclear. The registration record shows a commercial registrar but gives no usable ownership detail. Identity verification of the operator remains unconfirmed, and no legitimacy claim on the site can be credited. No third-party broker or regulatory-database entry matched the domain. The absence of a licence is a verification gap, but it is secondary to the confirmed external detections. The transport-layer facts confirm only that traffic is encrypted; they do not show that the operator is trustworthy. Evidence:

• Homepage: no legal entity, licence number, or regulatory reference appears anywhere in the captured content.
• Domain registration: registered through Ultahost, Inc., with a one-year term expiring August 2027.
• Transport encryption: a domain-validated TLS certificate issued by WE1, valid to 2027-01-08 (about 72 days remaining), which indicates domain control only and no organisational vetting.
• Hosting: served from AS13335 (Cloudflare, Inc., US).

What to Verify Next

Before any interaction, confirm independently whether the legitimate platform whose name this domain evokes operates any verification or connection service at all. Use only an address obtained from that platform's official documentation or another trusted offline route. Establish whether any regulator or licensing registry lists an operator for this domain. Verify the official support and contact channels directly with the platform, not through this site. Re-check the threat-listing status of the domain with several independent reputation services over the coming days, since status changes may show whether the detections are being resolved or are growing. Evidence:

• Domain registration: created in August 2026, so no long track record of legitimate operation exists to rely on.
• Homepage: it offers no on-site route to an identifiable operator, so verification must be sourced externally.
• Reputation checks: multiple independent detections are already present, which makes re-checking more informative than assuming a false positive.

Summary Verdict

The assessment is critical and clearly cautionary. A very new domain with a verification-themed name, confirmed external threat detections, and no identifiable operator forms a pattern consistent with phishing-style abuse. Technical hygiene such as valid encryption does not offset this. The site should be regarded as hazardous for any sensitive purpose.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and web application firewall, and all four observed addresses are edge servers within the same network, so the true origin server is not observable. Browser testing met a bot-protection challenge, and responses were stable across runs. These are mitigating factors only, because the same shielding is common to legitimate and abusive sites alike. The edge-only visibility also prevents independent verification of the real hosting and allows content to be swapped quickly. Heuristics flagged the combination of a young domain and sparse subdomains. This is unconfirmed and carries little weight beside the external detections.

Closing Assessment

The site should not be used for login, credential entry, wallet connection, or any financial activity. At most it should be viewed read-only from an isolated environment, and any link that led there should be reported and not followed again.