Is catlyzoon.xyz a scam? TrustSniffer's high-risk assessment: 10/100

Overview

The website at catlyzoon.xyz is a single-page, trading-themed site. It presents itself under the title "HSAL Trade Formula · BTC & Gold", which points to a trading-formula or signal offering built around Bitcoin and gold. Its apparent purpose is to attract visitors to a trading product or service. The captured evidence does not show the operator, the commercial terms, or the product mechanics.

Scam/Impersonation Risk

This domain is blacklisted. Multiple independent threat-intelligence sources currently flag it as malicious or suspicious, and the listing is corroborated across sources. That is a confirmed contradiction, not a speculative concern. It matters more because the domain was registered only weeks ago and has almost no history. A trading-formula brand on a brand-new domain with active threat listings matches the profile of short-lived, high-pressure investment lures. No conflicting legal entities or brand impersonation were observed, so this assessment rests on the threat listings and the domain's youth, not on identity conflicts. In the behavioural analysis of the homepage, nearly all of the page's network activity went to external, non-allow-listed hosts. No wallet-drainer behaviour, clipboard manipulation, hidden forms, cloaking or credential posts to third parties were detected. The absence of those behaviours does not offset the active listings, because a lure page can be harmless on first load and still be used for later solicitation. Evidence:

• Homepage: threat-intelligence sources currently list the domain as malicious and suspicious, and it also appears on an external blacklist.
• Domain provenance: registered 2026-09-12 (~0.11 years old, about 39 days) with a 2027-09-12 expiry.
• Web archive: 1 snapshot, captured 2026-09-26 and covering 2026 only (1 year tracked), so there is no meaningful operating history.
• Homepage behaviour: three sandbox runs all returned HTTP 200, and external requests made up a high share of page activity, with no drainer, cloaking or clipboard-hijack behaviour.

Regulatory Verification Notes

The evidence does not establish that the site is a regulated or licensed entity, and no third-party broker or regulator match was found for it. Because the homepage promotes BTC and gold trading, any legitimate offering of that kind would normally be expected to trace to a licensed or registered operator. That link is not currently demonstrable. The domain's registration details are shielded by a privacy service, which is treated here as an administrative matter, not an identity contradiction. Transport security is present but is not evidence of legitimacy, since a domain-validated certificate only confirms control of the domain. Evidence:

• Hosting: served from AS22612 (Namecheap, Inc., US), with the domain registered through Namecheap.
• Transport encryption: TLS certificate issued by SSL.com TLS Issuing RSA CA R1 (DV), valid to 2027-03-29.
• Homepage: no regulator, licence or registered-company reference was established in the captured evidence.

What to Verify Next

Before any interaction, confirm independently whether any named operator behind the "HSAL Trade Formula" offering holds a licence or registration with the financial regulator in the jurisdiction it claims. Do this through the regulator's own public register, not through links or reference numbers on the site. Search for independent reporting or complaints about the brand name from outside the site. Confirm any contact or support channel through an independent, offline route before sharing personal or financial information. Evidence:

• Homepage: the trading-formula branding for BTC and gold is the claim that needs regulator-level confirmation.
• Domain provenance: the site is weeks old, so no long-standing third-party record exists to rely on.
• Reputation: active threat listings mean any later improvement should be rechecked directly with the listing sources.

Summary Verdict

The overall posture is high risk. Active, corroborated threat listings combine with a very young domain and no independently verifiable operator. The site is not presently suitable for sensitive interactions, and the apparent legitimacy of its presentation is not supported by the evidence.

Infrastructure Integrity

The site resolves to a single IP address on Namecheap's shared hosting infrastructure, with no content delivery network or web application firewall detected in front of it. The network therefore provides no protective layer that could mitigate exposure. One abuse report exists against that shared IP and applies to the provider's shared address space. It is a minor, shared-infrastructure signal and is not attributable to this site alone. Young-domain DNS heuristics, namely a low footprint and sparse subdomains, are consistent with a newly stood-up deployment but are unconfirmed and add little on their own.

Closing Assessment

Treat the site as read-only at most. Do not log in, submit credentials, connect accounts, or send any payment or financial information to it until the active threat listings are cleared and an independent regulatory check confirms the operator.

Signals weighed against the site

• AbuseIPDB: 1 report on hosting IP 162.0.209.91 (Namecheap, Inc., Content Delivery Network), 1% confidence. The reports are attributed to shared infrastructure, not specifically to this website.