Is hyperliquid-eligibility.xyz safe?
http://hyperliquid-eligibility.xyz/
Coveragepartial2 of 4 applicable core capabilities
Fake Hyperliquid airdrop page mimics the real exchange layout and pushes a Connect Wallet button to drain visitors' crypto.
hyperliquid-eligibility.xyz is not the real Hyperliquid exchange. Research captured on the live site shows the Hyperliquid logo and navigation copied from the genuine hyperliquid.xyz, a hero block reading "Check your airdrop eligibility," and a single Connect Wallet button underneath. Hyperliquid's team has publicly stated that airdrops never require visitors to connect a wallet to a third-party site, because eligibility is determined directly from on-chain activity. That combination — a cloned brand layout, an eligibility checker that only asks for a wallet connection, and a statement from the real team denying any such checker exists — is a textbook airdrop-drainer setup. The domain is also only 163 days old, and the site's own page text could not be read because it returned HTTP 409, so nothing on the page itself was reviewed. Three antivirus engines flagged the URL as suspicious, and the domain name was chosen to look like an official Hyperliquid property. The score is in the Dangerous band.
Be the first to review hyperliquid-eligibility.xyz
Lost money to hyperliquid-eligibility.xyz? Warn others
Loading saved screenshot
Preparing the saved page preview.
Where this site sits
- Dangerous1–20
- High Risk21–44
- Moderate Risk45–69
- Low Risk70–84
- Safe85–100
The score combines saved evidence strength and analysis quality. Coverage is reported separately.
01 · Investigation Brief
Investigation Brief
hyperliquid-eligibility.xyz is not the real Hyperliquid exchange. Research captured on the live site shows the Hyperliquid logo and navigation copied from the genuine hyperliquid.xyz, a hero block reading "Check your airdrop eligibility," and a single Connect Wallet button underneath. Hyperliquid's team has publicly stated that airdrops never require visitors to connect a wallet to a third-party site, because eligibility is determined directly from on-chain activity. That combination — a cloned brand layout, an eligibility checker that only asks for a wallet connection, and a statement from the real team denying any such checker exists — is a textbook airdrop-drainer setup. The domain is also only 163 days old, and the site's own page text could not be read because it returned HTTP 409, so nothing on the page itself was reviewed. Three antivirus engines flagged the URL as suspicious, and the domain name was chosen to look like an official Hyperliquid property. The score is in the Dangerous band.
A cloned Hyperliquid page with one purpose: get a wallet connected
The observed page opens with the Hyperliquid logo in the top-left, a navigation bar laid out to match the real hyperliquid.xyz, and a hero block that reads "Check your airdrop eligibility." Below that hero there is exactly one interactive element: a Connect Wallet button. Nothing else on the captured page suggests a legitimate service — no documentation, no terms, no team information, no fee schedule tied to a real product.
The problem is what that button asks a visitor to do. Connecting a wallet to an untrusted site can hand over on-chain permissions — token approvals or signature requests — that let the operators move assets out of the connected wallet. A genuine airdrop eligibility check does not need a live wallet connection at all, and the real Hyperliquid team has said so explicitly.
The real Hyperliquid says no wallet connection is ever required for eligibility
Hyperliquid has stated publicly that its airdrops never require users to "connect to verify eligibility." Eligibility is read directly from on-chain activity by the team, so no third-party checker that asks for a wallet connection can be legitimate. Any site claiming otherwise is asserting something the real project has already denied.
The domain name itself reinforces the impersonation: hyperliquid-eligibility.xyz borrows the Hyperliquid brand and adds an eligibility hook to look like an official airdrop utility. Registered only 163 days before this scan, it has none of the institutional history of the exchange it is imitating.
Independent scanners and antivirus engines also flag this URL
Three antivirus results — from alphaMountain.ai, Forcepoint ThreatSeeker and Gridinsoft — marked this URL as suspicious. That is independent security-vendor evidence, not just a category label. The saved observation is stale, so the timing of the detections should be confirmed, but the flags themselves are real.
The site's own page content could not be read because it returned HTTP 409, which means the operator's contact details, About text and any policies were never reviewed. A valid TLS certificate and the absence of a the browser threat feed warning do not offset that: encryption only protects the connection, and Safe Browsing not yet listing a 163-day-old phishing domain is no assurance of safety.
Why the score is 15
One public warning on a scam-warning or security site: "The page at hyperliquid-eligibility.xyz opens with the Hyperliquid logo at top-left, a navigation bar matching the real hyperliquid.xyz layout, and a hero…". Coverage remains separate so missing sources cannot be mistaken for clean results.
02 · Security Evidence
Security evidence
Antivirus Engines
3/ 92
detectionsSaved analysis from October 2, 2026 - stale
3 engines flagged this URL
Every saved adverse engine is listed below. The full provider matrix remains available for audit.
- Malicious
- 0
- Suspicious
- 3
- Total
- 92
| Engine | Finding |
|---|---|
| alphaMountain.aiSuspicious | suspicious |
| Forcepoint ThreatSeekerSuspicious | suspicious |
| GridinsoftSuspicious | suspicious |
All 92 engine results
- alphaMountain.ai - Suspicious
- Forcepoint ThreatSeeker - Suspicious
- Gridinsoft - Suspicious
- 0xSI_f33d - Unrated
- Abusix - Clean
- Acronis - Clean
- ADMINUSLabs - Clean
- AILabs (MONITORAPP) - Clean
- AlienVault - Clean
- AlphaSOC - Unrated
- Antiy-AVL - Clean
- ArcSight Threat Intelligence - Unrated
- AutoShun - Unrated
- Bfore.Ai PreCrime - Unrated
- BitDefender - Clean
- Bkav - Unrated
- BlockList - Clean
- Blueliv - Clean
- Certego - Clean
- ChainPatrol - Unrated
- Chong Lua Dao - Clean
- CINS Army - Clean
- CRDF - Clean
- Criminal IP - Unrated
- CSIS Security Group - Unrated
- CTX AI - Clean
- Cyan - Unrated
- Cyble - Clean
- CyRadar - Clean
- desenmascara.me - Clean
- DNS8 - Unrated
- Dr.Web - Clean
- EmergingThreats - Clean
- Emsisoft - Clean
- Ermes - Unrated
- ESET - Clean
- ESTsecurity - Clean
- Fortinet - Clean
- Fortra - Unrated
- G-Data - Clean
- GCP Abuse Intelligence - Unrated
- Google Safe Browsing - Clean
- GreenSnow - Clean
- GreyNoise - Unrated
- Guardpot - Unrated
- Heimdal Security - Clean
- Hunt.io Intelligence - Unrated
- IPsum - Clean
- Juniper Networks - Clean
- K7AntiVirus - Unrated
- Kaspersky - Clean
- LevelBlue - Clean
- Lionic - Clean
- Lumu - Unrated
- Malwared - Clean
- MalwarePatrol - Clean
- MalwareURL - Unrated
- Mimecast - Unrated
- Netcraft - Unrated
- OpenPhish - Clean
- PhishFort - Unrated
- Phishing Database - Clean
- Phishtank - Clean
- PREBYTES - Clean
- PrecisionSec - Unrated
- Quick Heal - Clean
- Quttera - Clean
- Rising - Clean
- SafeToOpen - Unrated
- Sangfor - Clean
- Sansec eComscan - Unrated
- Scantitan - Clean
- SCUMWARE.org - Clean
- Seclookup - Clean
- Snort IP sample list - Unrated
- SOCRadar - Unrated
- Sophos - Clean
- StopForumSpam - Clean
- Sucuri SiteCheck - Clean
- Synthient - Unrated
- ThreatHive - Clean
- URLhaus - Clean
- URLQuery - Unrated
- Viettel Threat Intelligence - Clean
- VIPRE - Unrated
- ViriBack - Clean
- VX Vault - Clean
- Webroot - Clean
- Xcitium Verdict Cloud - Clean
- Yandex Safebrowsing - Clean
- ZeroCERT - Clean
- ZeroFox - Unrated
Security Scans
Checked against the browser threat feeds available to this scan — no hit.
What we observed
Loading saved screenshot
Preparing the saved page preview.
Visual context from the captured page
Check domain settings
What the captured page showed
1 observation- 01
Check domain settings
03 · Investigation Story
Investigation story
What the site claims
Independent evidence classifies the site as login portal, but the page's own claim could not be captured.
What we observed
The page itself could not be fully inspected, so the report relies on the other saved checks.
What independent research found
2 external findings were saved and compared with the page evidence.
What remains unverified
2 of the 4 applicable core capabilities did not complete, so those gaps remain visible in the coverage ledger.
What kind of site and risk is this?
Threat category
Investment, Crypto & Wallet Fraud
Service and business model
Login Portal
Observed behavior
Evidence behind this classification
- 01One public warning on a scam-warning or security site: "The page at hyperliquid-eligibility.xyz opens with the Hyperliquid logo at top-left, a navigation bar matching the real hyperliquid.xyz layout, and a hero…"
- 023 antivirus results marked the URL as suspicious. This comes from a saved antivirus observation rather than a new submission, so treat the detection as real but confirm the timing.
- 03The registrable domain hyperliquid-eligibility.xyz is 163 days old and its name mirrors the Hyperliquid brand plus an eligibility hook.
What this means for you
What happens if a visitor follows the page's one call to action
A visitor drawn by an airdrop-eligibility claim arrives on a page styled like Hyperliquid and is shown a single Connect Wallet button. Following that prompt is the only meaningful action the page offers, and it is the action this kind of page exists to provoke.
How the observed mechanism works
The evidence-backed path
Each stage below is preserved from the grounded analysis and linked to saved evidence.
The pretence is broken by the real project's own statement: Hyperliquid airdrops are read from on-chain activity and never require a wallet connection to a third-party checker. A wallet connection on this page therefore serves the operator, not the visitor, and can carry approval or signature requests capable of moving funds out of the connected wallet.
Do not connect a wallet to hyperliquid-eligibility.xyz and do not sign any transaction or approval it proposes. The real Hyperliquid has stated it never asks users to connect a wallet to verify airdrop eligibility, so any page doing that is impersonating the project. Reach Hyperliquid only through its official domain, treat unsolicited airdrop-eligibility links as hostile, and if you have already connected a wallet to this site, revoke its approvals through a trusted wallet interface immediately. If you have already signed something, move remaining assets to a clean wallet as soon as possible.
Web research findings
Independent findings for hyperliquid-eligibility.xyz, including public complaints, named review sources, registration records, and look-alike-domain evidence. A missing result is shown as unverified, never converted into a clean bill of health.
- SafeBrowzopen
"The page at hyperliquid-eligibility.xyz opens with the Hyperliquid logo at top-left, a navigation bar matching the real hyperliquid.xyz layout, and a hero block that says "Check your airdrop eligibility." Below the hero there is a single Connect Wallet button."
- SafeBrowzopen
"The team has also stated publicly that Hyperliquid airdrops never require users to "connect to verify eligibility." Eligibility for Hyperliquid airdrops is determined by on-chain activity that the team can read directly. There is no eligibility checker that requires a wallet connection."
Reputation Sources
How this domain rates across independent threat-intelligence and blocklist providers.
04 · Domain & Infrastructure
Domain & infrastructure
The plumbing behind the site — who registered it, how it’s encrypted, where it’s hosted, and where it links out. A valid certificate or a calm server doesn’t mean the business is honest — scam sites pass these checks too. Use this to corroborate the verdict, not to overturn it.
Infrastructure map
How the saved page connected to the wider web.
- Domainhyperliquid-eligibility.xyz
- Redirects tohyperliquid-eligibility.xyz
- Hosted byCloudflare, Inc.
Domain Timeline
- May 12, 2026Domain registered
First appeared in WHOIS records — 5 months old when this review was saved.
- Oct 23, 2026Saved security review — Rated Dangerous
The completed checks from this saved scan are detailed above.
hyperliquid-eligibility.xyz was registered very recently when this review was saved and was already flagged. Freshly-registered domains are disproportionately used for scams, and a young domain with active threat signals warrants extra caution.
Domain & Encryption
Server Reputation
05 · Evidence Ledger
Evidence ledger
- Antiviruspartial
- Browser threat feedcomplete
- Page contentpartial
- Analysiscomplete
- Visual evidencepartial
The conclusion is supported by the evidence saved with this report.
Technical threat
unknownMalware, phishing, credential theft and hostile infrastructure.
3 antivirus results marked the URL as suspicious. This comes from a saved antivirus observation rather than a new submission, so treat the detection as real but confirm the timing.
Operator / customer risk
suspiciousComplaints, withdrawals, business conduct and commercial traps.
One public warning on a scam-warning or security site: "The page at hyperliquid-eligibility.xyz opens with the Hyperliquid logo at top-left, a navigation bar matching the real hyperliquid.xyz layout, and a hero…" · The registrable domain hyperliquid-eligibility.xyz is 163 days old and its name mirrors the Hyperliquid brand plus an eligibility hook.
Source coverage and freshness
Status shows whether usable evidence was saved; finding shows what that evidence observed.
| Source | Result | Completion | Finding | Freshness |
|---|---|---|---|---|
| Antivirus | 3 of 92 engines flagged | Limited | Adverse | stale fallback · analysed Oct 2, 2026 |
| Browser protection | No browser threat-list match | Completed | No adverse finding | this scan · Oct 23, 2026 |
| Page content | Page content was not available for semantic review | Limited | No saved finding | this scan · Oct 23, 2026 |
| Visual evidence | The site blocked our capture or showed an error page; 1 visible observation saved | Limited | No saved finding | this scan · Oct 23, 2026 |
| Independent research | 2 independent findings were saved | Completed | Adverse | this scan · Oct 23, 2026 |
- Antivirus
- Result3 of 92 engines flagged
- CompletionLimited
- FindingAdverse
- Freshnessstale fallback · analysed Oct 2, 2026
- Browser protection
- ResultNo browser threat-list match
- CompletionCompleted
- FindingNo adverse finding
- Freshnessthis scan · Oct 23, 2026
- Page content
- ResultPage content was not available for semantic review
- CompletionLimited
- FindingNo saved finding
- Freshnessthis scan · Oct 23, 2026
- Visual evidence
- ResultThe site blocked our capture or showed an error page; 1 visible observation saved
- CompletionLimited
- FindingNo saved finding
- Freshnessthis scan · Oct 23, 2026
- Independent research
- Result2 independent findings were saved
- CompletionCompleted
- FindingAdverse
- Freshnessthis scan · Oct 23, 2026
07 · Safety FAQ
Safety FAQ
Common questions, answered directly from the scan data above — so the answers reflect the saved verdict and evidence in this report.
Is hyperliquid-eligibility.xyz a scam or a legit crypto platform?
Is hyperliquid-eligibility.xyz safe to use?
I already deposited money on hyperliquid-eligibility.xyz — what should I do?
Can I get my money back from hyperliquid-eligibility.xyz?
Is hyperliquid-eligibility.xyz a Ponzi scheme or a real crypto investment?
How do I report hyperliquid-eligibility.xyz?
hyperliquid-eligibility.xyz looks professional — how can it still be a scam?
Has hyperliquid-eligibility.xyz been flagged by antivirus engines?
Is hyperliquid-eligibility.xyz on any phishing or malware blacklists?
How old is the hyperliquid-eligibility.xyz domain?
Where is hyperliquid-eligibility.xyz hosted?
How often is the hyperliquid-eligibility.xyz report updated?
08 · Final Verdict
Final verdict
Fake Hyperliquid airdrop page mimics the real exchange layout and pushes a Connect Wallet button to drain visitors' crypto.
hyperliquid-eligibility.xyz is not the real Hyperliquid exchange. Research captured on the live site shows the Hyperliquid logo and navigation copied from the genuine hyperliquid.xyz, a hero block reading "Check your airdrop eligibility," and a single Connect Wallet button underneath. Hyperliquid's team has publicly stated that airdrops never require visitors to connect a wallet to a third-party site, because eligibility is determined directly from on-chain activity. That combination — a cloned brand layout, an eligibility checker that only asks for a wallet connection, and a statement from the real team denying any such checker exists — is a textbook airdrop-drainer setup. The domain is also only 163 days old, and the site's own page text could not be read because it returned HTTP 409, so nothing on the page itself was reviewed. Three antivirus engines flagged the URL as suspicious, and the domain name was chosen to look like an official Hyperliquid property. The score is in the Dangerous band.
09 · Community