Is alchyra.com a scam? TrustSniffer's high-risk assessment: 21/100

Overview

Alchyra is a newly launched website that presents itself, in its homepage title, as a "0% fee non-custodial DEX aggregator". It positions itself as a tool that routes cryptocurrency token swaps across decentralized exchanges without taking custody of user funds. The apparent purpose is to draw visitors into on-chain trading activity. The captured material does not explain how a zero-fee service funds itself.

Scam/Impersonation Risk

This is the decisive section of the assessment. The domain is blacklisted: external threat-intelligence sources currently flag it, and this is a confirmed contradictory signal rather than a soft reputational hint. The flag is amplified by the domain's extreme youth, since it was registered only about a month before analysis. A newly created crypto-trading front end, one that asks visitors to trust it with swap routing and potentially wallet interactions, is a well-known template for drainer and phishing campaigns. The "non-custodial" and "0% fee" claims are marketing assertions that cannot be treated as evidence of safety. Two points weigh in the site's favor: no conflicting legal identities and no brand impersonation were observed. Automated behavioral testing also found no wallet-drainer routines, clipboard manipulation, hidden or credential-harvesting forms, or cloaking, and only a few external requests, all to recognized destinations. These findings do not offset the blacklisting. They only show that no malicious payload was triggered during the limited test sessions. Evidence:

• Homepage: the title advertises a "0% Fee Non-Custodial DEX Aggregator"; no independent corroboration of either claim exists in the evidence.
• Domain registered 2026-09-10 (~0.11 years old); the web archive holds 2 snapshots, both captured on 2026-09-11.
• Reputation checks: external blacklist flag active, with one engine rating the domain malicious and two rating it suspicious.
• Behavioral sandbox: 3 of 3 runs completed with 0 wallet-drainer, clipboard-hijack, hidden-form or cloaking detections.

Regulatory Verification Notes

The evidence does not tie the site to any identifiable legal operator, and no regulatory authorization could be confirmed from a third-party source. Ownership is opaque. That is an administrative limitation, not an identity contradiction in itself. For a service that handles token trading and routes value between parties, the absence of a verifiable operating entity, jurisdiction or licensing status is material in context, and it compounds the blacklisting. No third-party broker or regulator database entry matched this domain, so no external reputational reading is available either way. The domain's TLS certificate is valid but is only domain-validated, so it confirms encryption and control of the domain and nothing about who operates the service. Evidence:

• Registered through Porkbun LLC, with registration running to 2027-09-10.
• Served from AS13335 (Cloudflare, Inc., US).
• TLS certificate issued by WE1 (DV), valid to 2026-12-10, with about 49 days remaining.
• The domain does not appear in the DeFi protocol directory, so no recognized TVL is recorded for it.

What to Verify Next

Any engagement should be preceded by confirming the operator through channels independent of the site: a registered legal entity, a named team, and a jurisdiction that can be checked against public corporate and financial-regulator registers. The "non-custodial" claim should be tested against published, audited smart-contract addresses on a block explorer, not against site copy. The brand should also be compared with established aggregators to rule out a look-alike. Official support and social channels should be confirmed through an offline or well-known route, not through links on the site. Evidence:

• Homepage: the non-custodial and zero-fee claims need on-chain and audit corroboration.
• Legal and contact pages: no verifiable operating entity could be established from the supplied evidence.
• Reputation: the active blacklist flag should be rechecked against current threat-intelligence listings before any interaction.

Summary Verdict

The overall posture is high risk. A confirmed blacklisting on a very young domain with no verifiable operator outweighs the technically clean behavior and valid encryption. The available evidence does not support treating this site as legitimate, and its apparent professionalism is not a mitigating factor.

Infrastructure Integrity

The site runs behind a major CDN and web application firewall, and the observed addresses are all edge nodes, so the origin server is not observable. This is a mitigating factor only. It supplies a mainstream, well-maintained transport and delivery layer. It also prevents independent verification of the true hosting location and makes rapid content swaps harder to detect. It does not offset the reputational findings.

Closing Assessment

At most, the site should be viewed read-only. No wallet connection, credential entry, token approval or funds transfer should take place unless a trusted independent source later clears the domain and its operator.