Is checker-trenches.com a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

The website at checker-trenches.com is a very recently registered, single-page property. Its homepage carries only a short block of text under the page title "tren.ch". That text gives a visitor no clear product description, company identity or service terms, so the site's purpose and business model cannot be established from the site itself. The name and title suggest a tool or utility aimed at the online token-trading community, but the site does not say so.

Scam/Impersonation Risk

Multiple independent reputation sources currently flag this domain as malicious, so this assessment is clearly cautionary. Several security engines classify the site as malicious and more treat it as suspicious. Among them is at least one widely recognised security vendor, and the detections are corroborated, not isolated. This is a confirmed blacklist condition, and it is the decisive factor in the assessment. No brand impersonation, phishing page or conflicting legal identities were observed in the captured content. The risk comes from external threat listings, not from contradictions in what the site says about itself. During automated interaction the homepage sent three data submissions to third-party destinations that are not part of any recognised, expected service set. About two-fifths of the observed requests went to outside hosts. Those hosts could not all be attributed. For a page with so little visible content, this volume of outbound data traffic is disproportionate. No wallet-connection prompts, clipboard manipulation, hidden forms, credential forms posting to external hosts or content cloaking were detected. The risk therefore rests on the threat listings and the unexplained outbound traffic, not on a demonstrated drainer or credential-harvesting mechanism. The site's youth reinforces the concern, because it has had no time to build a track record that could offset the listings. Evidence:

• Homepage: security engines return five malicious and three suspicious verdicts, and the listing is corroborated across sources.
• Homepage behaviour: three third-party POST submissions and six non-whitelisted external requests across three successful runs, with about 40% of requests going to external hosts.
• Homepage behaviour: no wallet-provider interaction, clipboard writes, hidden forms or cloaking were observed.
• Domain provenance: registered in August 2026 through NICENIC International Group Co., Limited, about 0.19 years (roughly 70 days) old.

Regulatory Verification Notes

The captured homepage is too thin to count as a disclosure surface. It names no operating company and gives no registration number, licence, terms or privacy policy, and it links to no legal or identity pages. This is a content gap on the site's side. No third-party broker or regulator record matched the domain, so there is no reputational context to weigh. The site presents no regulated financial offering, and its text does not identify an operator who could be checked against a registry. The site's transport encryption is valid but is only a basic domain-validated certificate. It proves control of the domain, not the identity or trustworthiness of the operator, and it does not offset the threat listings. Evidence:

• Homepage: about 280 characters of text, with no company name, licence or registration reference and no legal pages.
• Transport encryption: TLS certificate issued by WE1 (DV), valid to 2027-01-13.
• Domain record: registration expires 2027-08-16, a one-year term with no multi-year commitment.

What to Verify Next

Any engagement should first be checked against current threat-intelligence listings. Those listings should be re-checked later, since a status that changes may show a clean-up or a compromise. The destinations that receive the homepage's outbound submissions should be identified before any interaction. Any claim that the site belongs to an established service should be checked through that service's official channels, using an independent route and not links or contact details taken from this site. Any support or contact channel should be confirmed the same way. Evidence:

• Homepage: three outbound third-party submissions whose recipients could not be fully attributed.
• Domain record: roughly two months of registration history, with no prior track record to rely on.

Summary Verdict

The overall posture is high-risk. Confirmed external blacklisting, a domain only weeks old and a near-empty homepage combine into an assessment that cannot support trust, and the site's operator identity remains unverified. Protective technical features and clean on-page behaviour on several indicators do not change that conclusion. At most, they show that no active credential-theft mechanism was demonstrated in the captured session.

Infrastructure Integrity

The site is served from AS13335 (Cloudflare, Inc., US) behind a reputable CDN and WAF, and all four observed addresses are edge servers. The origin server could not be observed, so the actual hosting cannot be independently verified, and the edge layer could mask rapid content changes. This protection is a mitigating factor only. Shared infrastructure of this kind is used by both legitimate and abusive sites, and it does not reduce the external threat listings. The domain's young age and sparse subdomain footprint are an unconfirmed heuristic and add no confirmed risk beyond the above.

Closing Assessment

The site should be treated as unsafe for any sensitive interaction. Do not log in, enter credentials, connect a wallet or make payments or transfers. Viewing the homepage without taking any action is the only use consistent with this assessment. The risk should be re-evaluated only if the threat listings are formally cleared and the operator is independently identified.