Is trade-world.xyz a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website presents itself as "World — Terminal Concept", a trading terminal for perpetual futures and a Solana-focused prediction market. A visitor is asked to connect a crypto wallet and deposit funds from several chains before trading. The apparent business model is fee income from trading activity, with per-trade fees of roughly 0.00021 SOL and trades routed through "solver agents". Staking, rewards, points, a planned token and an airdrop are offered as future incentives.

Scam/Impersonation Risk

The evidence shows confirmed adverse contradictions. The domain is blacklisted: several major threat-intelligence engines flag it as malicious or suspicious, including a tier-one security vendor, and an independent blacklist corroborates this. This is the decisive factor in the assessment. No brand impersonation or conflicting legal identities were detected. The homepage describes itself as an "unofficial fan render" not affiliated with another project, which does not explain or offset the listings. The homepage also reads as engineered to appear credible without substance. It asserts a total value locked of $1.2 billion and $280 million of "restaked security", plus staking, rewards, points, a planned WORLD token and an airdrop, each backed only by a bare "Yes" and no mechanics, rates or audit. It advertises "400ms finality" and a "quantum-entangled zkEVM fork" next to "sub-attosecond finality*", with a footnote admitting this is "not physically meaningful". It also shows "community reaction" testimonials that the page itself labels as paraphrased. The flow asks for a wallet connection, a multi-chain deposit (SOL, Base, ETH) and a leveraged trade order before any verifiable service exists. This is a deposit-before-service pattern with opaque value flow. In balance, the sandbox observed no wallet-drainer behaviour, clipboard tampering, hidden forms or undisclosed outbound data traffic. The risk therefore rests on reputation, business model and claim integrity rather than on observed malicious code execution. Evidence:

• Homepage: claims of $1.2B TVL, $280M restaked security, staking, rewards, points, a planned token and an airdrop are made with no supporting evidence.
• Homepage: the "sub-attosecond finality*" footnote and the paraphrased testimonials undermine the credibility of the technical and social-proof claims.
• Domain provenance: registered 2026-06-29 (~0.31 years old). The web archive holds only 2 snapshots spanning 2021–2026 (6 years tracked), so no continuous operating history exists for the current registration.
• Reputation: external threat-intelligence listings are active, with multiple engines reporting the domain as malicious or suspicious.

Regulatory Verification Notes

The homepage, the only page assessed, names no legal entity, operator, team, licence, registration number, audit or risk disclosure. It also lists no usable contact or address channel. Operator identity is unverified and governance is opaque. For a platform that takes deposits and offers leveraged products, these omissions are material. No third-party broker or regulatory database match was found, so the absence of regulatory standing is not offset by any external recognition. The domain was registered through NICENIC International Group Co., Limited. Its expiry date is 2027-06-29, so registration is only short-term. The site holds a valid but basic domain-validated certificate, which proves only that the domain was controlled when the certificate was issued. It says nothing about the operator's legitimacy. Evidence:

• Homepage: no legal entity, licence, audit, risk disclosure or contact channel is present, and the page disclaims affiliation with the project whose name it echoes.
• Transport encryption: TLS certificate issued by WE1 (DV), valid to 2026-11-25 with about 35 days remaining.
• Hosting: served from AS13335 (Cloudflare, Inc., US).
• Registration: registrar NICENIC International Group Co., Limited; created 2026-06-29, expires 2027-06-29.

What to Verify Next

Any engagement should be preceded by confirmation of who operates the platform. The first step is to look for an official source for the project the page echoes, reached independently of this site, and to check whether it recognises this domain. Next, any claimed financial-services authorisation should be tested against the relevant national registry. The site currently claims none, so nothing can be confirmed. The claimed TVL and restaked-security figures should be checked against independent on-chain analytics rather than the site's own counters. The official support and contact channels should be confirmed through an independent route. Until the threat-intelligence listings are explained or removed, no wallet should be linked and no funds sent. Evidence:

• Homepage: the TVL and restaked-security figures are unsupported by any linked audit or on-chain reference.
• Homepage: wallet-connect, deposit-amount and trade-order controls are present on the single form.
• Domain provenance: registration is about 114 days old, with a thin archive record.

Summary Verdict

The assessment is a clearly high-risk posture. Corroborated reputational listings, an unverifiable operator, and a deposit-first trading model with unsupported headline claims converge on the same conclusion. The site shows no offsetting indicators of an established, accountable service.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and WAF, and all four observed addresses are edge servers in the US. The origin server was not observable. Edge-only visibility limits independent hosting verification and can mask rapid content changes. This protective infrastructure is a mitigating factor only. It does not offset the reputational findings, and it says nothing about who operates the site.

Closing Assessment

The site should be treated as unsafe for any login, wallet connection, deposit or financial interaction. At most, it may be viewed read-only, with no credentials or funds committed. Anyone who has already connected a wallet or deposited funds should revoke the wallet permissions and report the domain to their security team or relevant authority.