Is claim-npc.live a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

The website claim-npc.live is a single-page "Non-Playable Coin (NPC)" landing page that presents itself as the first memecoin-NFT hybrid, "est. 2023". Its main call to action is a "Claim" flow in which a visitor connects a crypto wallet, reviews an allocation and confirms an on-chain transaction to receive a token. Beyond the claim flow, the page offers social links, a row of exchange names and a teaser for a forthcoming "launchly" mediacoin launcher. Its apparent purpose is to funnel visitors into wallet-based token transactions, and it does not state how the project is funded or monetised.

Scam/Impersonation Risk

Hard contradictory signals are present, and the assessment is clearly cautionary. A substantial cluster of established security engines currently classifies the domain as malicious, and several of the most widely deployed enterprise-grade engines are among them. This amounts to a confirmed blacklisting and is the decisive factor in the verdict. No brand impersonation, phishing form or conflicting legal identity was observed. The risk therefore comes from the external threat listing together with the nature of the page itself. The homepage asks visitors to connect a wallet and confirm a transaction, warns that completed claims "may not be reversible", and points to only a generic support pop-up if something goes wrong. Its own footer disclaimer says the token has no intrinsic value, financial expectations, team or roadmap and exists "purely for entertainment". A transaction-based claim sits uneasily with that wording. The page also lists major exchanges (Uniswap, Kraken, Binance US, KuCoin, MEXC, Gate, Bitget and "+12 more") without any contract address or verifiable link to support the implied listings. That is a recognised pattern in token-claim lures, in which a legitimate-looking exchange row lends borrowed credibility to a wallet-approval flow. The sandbox did not observe wallet-drainer behaviour, clipboard manipulation or hidden forms. This does not offset the external detections, because a claim flow can be pointed at malicious contracts after the page has been assessed.

Regulatory Verification Notes

The site presents no legal entity, registered company, licence or jurisdiction. The footer carries only the generic line "© 2026 Non-Playable Coin" and a non-affiliation statement naming public figures. The page does not claim any financial or virtual-asset authorisation. The absence of licensing information is a verification gap rather than proof of wrongdoing, but with a transactional crypto flow it leaves no accountable party to turn to. The disclaimer's disavowal of any team or roadmap reinforces this. The "est. 2023" claim is not supported by the domain's provenance. The domain was registered only weeks ago, and web-archive coverage begins days after registration and shows almost no history. No external broker-reputation record matched this site, so no third-party reputational signal is offered here. The extremely young registration, the near-empty archive record and the absence of any named operator together mean that nothing independent corroborates the project's stated age or identity.

What to Verify Next

No wallet connection or transaction should be considered until the project can be independently confirmed. The first step is to locate the token's contract address through channels not linked from this page, such as the exchanges the page names, and check it against a public blockchain explorer for holder distribution, creation date and contract permissions. Each named exchange should be queried directly to confirm that an NPC listing exists, since the page gives no verifiable link. Anyone who already interacted with the site should review and revoke any wallet approvals granted to unfamiliar contracts, and move assets from any wallet that signed a transaction. Official support and social channels should be confirmed through independent routes. The "est. 2023" origin claim should be checked against historical, independently indexed project records rather than this domain.

Summary Verdict

The site sits in the highest-risk tier. Confirmed external threat detections, a freshly created domain and an unverifiable, irreversible wallet-transaction mechanic converge on the same conclusion. Superficial polish, valid encryption and a stable, responsive page do not change that. It is assessed as unsafe for any sensitive or financial interaction, and its identity and purpose cannot be substantiated.

Infrastructure Integrity

The site is fronted by Cloudflare's CDN and WAF. All observed addresses are edge servers, and the origin server was not visible. The site also runs bot-protection that the sandbox classified as ordinary rather than cloaking. This protective layer is a mitigating technical signal only. It shows that the site is competently fronted, not that its operator or content is legitimate. Edge-only visibility also prevents independent hosting verification and could conceal rapid content changes, so it cannot offset the reputation findings.

Closing Assessment

The site should be treated as read-only at most, and ideally avoided altogether. Wallets should not be connected, credentials should not be entered, and no funds or approvals should be committed. Anyone who has already engaged should act promptly to limit exposure.