Is boredapeyachtclubmemberverify.com a scam? TrustSniffer's high-risk assessment: 2/100

Security Alert

Fortinet flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a single-page site on a domain whose name combines a well-known NFT collection with the phrase "member verify". It presents a minimal homepage with only a short block of text and a browser title reading "fastpanel", which resembles a hosting control-panel label. The domain wording points to a members' verification or access portal for that NFT community, but the page shows no branded content, organisational description or commercial offering.

Scam/Impersonation Risk

This is the dominant concern. The domain was registered only weeks ago, and its name pairs a prominent digital-collectible brand with a verification lure. That pattern is typical of credential-harvesting and wallet-targeting campaigns that trade on a community's name. The site carries a confirmed external blacklist hit. At least one major security engine rates the domain malicious and several others rate it suspicious, and the domain is also linked to known phishing activity. The homepage shows a mismatch between the brand-laden domain name and the generic control-panel title with sparse text, which is consistent with a staging or lure page rather than an operating community service. Sandbox observation of the homepage found no wallet-connection prompts, wallet-drainer routines, clipboard manipulation, hidden forms or credential posts to external hosts, so no active exploit mechanism was captured in these sessions. Nearly all of the page's network activity went to external destinations, however, including repeated outbound POST requests and repeated console errors. This does not itself prove malicious intent, but alongside the blacklist hit it supports a high-risk reading. No conflicting legal entities were observed, because no identity pages exist to compare. Evidence:

• Domain registered 2026-08-17 (~0.19 years, about 69 days old) and set to expire 2027-08-17.
• Homepage title "fastpanel" and roughly 400 characters of text, with no brand, product or community content matching the domain name.
• Homepage sessions recorded 9 outbound POST requests and 27 external XHR/fetch calls, with external traffic dominating the page's activity and 9 console errors across three runs.
• External reputation checks show a blacklist hit with one malicious and three suspicious verdicts. Neither the safe-browsing check nor the broker dataset returned a match.

Regulatory Verification Notes

No licensing, registration or regulatory standing is evidenced anywhere. The only page captured carries no legal-entity name, terms, privacy policy or about information, and the real-world operator cannot be independently connected to any brand or person. Registrant details are incomplete, so ownership is opaque, which is an administrative limitation separate from the reputational findings. No third-party broker or regulator record matched this domain, and the absence of a match is neither a clearance nor a finding. The credible brand association that the domain name implies is not supported by any on-site evidence. Evidence:

• Registrar: Ultahost, Inc., with incomplete registrant data.
• Served from AS13335 (Cloudflare, Inc., US), with an observed DNS pattern of a young domain and sparse subdomains.
• TLS certificate issued by WE1 (DV, domain validation only), valid to 2027-01-13. This shows encryption but does not confirm the operator's identity.
• The homepage contains no company name, licence number or legal pages.

What to Verify Next

Any claim of an official member-verification service should be checked through the NFT collection's own channels, reached independently of this domain, such as its publicly announced official website and verified social accounts. Members should confirm whether the collection has ever announced a verification portal and under which domain. Any message, advertisement or direct message that directed a recipient to this address should be treated as unsolicited and reported to the platform it came from. Security teams should check whether the domain appears in mail or web logs, and should consider blocking it at the organisation's gateway. Evidence:

• The homepage offers no verifiable channel through which the operator can be reached or authenticated.
• External security vendors currently list the domain as malicious or suspicious.
• The domain's registration is recent, so no established record of legitimate operation exists to compare against.

Summary Verdict

The assessment is clearly cautionary. A confirmed external blacklist hit, a very recent registration, a brand-evoking verification lure and unverifiable operator identity converge on an elevated-risk classification. The technically clean transport encryption and the absence of captured exploit behaviour are not enough to offset this reputation signal.

Infrastructure Integrity

The site is delivered through Cloudflare's CDN and WAF, and all observed addresses are edge servers, so the origin host could not be observed. This protection and the valid certificate are mitigating factors only, because they are available to any customer regardless of intent. Edge-only visibility also prevents independent verification of the hosting and would allow content to be swapped quickly without any change at the network layer.

Closing Assessment

Interaction should be limited to passive viewing in an isolated environment. No wallet connection, credential entry, seed-phrase disclosure or payment should take place on this domain. Anyone who has already interacted with it should revoke wallet approvals, change affected passwords and notify the relevant platform or security team.