Is claim-plrl.com a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

The website at claim-plrl.com is a single-entry web property whose captured homepage carries the title "PLRL - The internet equity layer". It presents itself as a branded "equity layer" proposition, and the "claim" wording in its domain frames it as a portal where visitors are invited to claim something. Its apparent purpose is to draw visitors into a claim-style interaction under the PLRL name. The captured page text supports no more detail than this about specific products, yields or mechanics.

Scam/Impersonation Risk

Contradictory signals are present and serious. A substantial number of major security vendors independently classify the domain as malicious, with several more rating it suspicious. This includes multiple top-tier vendors, which is enough to confirm that the site is blacklisted. A phishing association is also recorded against the domain in its threat history. The domain is also newly registered, and its name pairs a "claim" prefix with a brand-like token. That pattern is typical of lookalike claim pages, which present a branded token or reward "claim" to harvest credentials or wallet access. The pattern is a contextual indicator, not proof of what this page does. Automated browsing sessions of the homepage did not observe external data submissions, wallet-drainer behaviour, clipboard tampering, hidden forms or cloaking. That is a limited finding and does not offset the external detections, because a malicious function can be activated later or only for particular visitors. The site does not appear in any major DeFi protocol directory, so no established protocol identity stands behind the "equity layer" claim. No conflicting legal entities were observed, but only because no operator is named. Evidence:

• Homepage: titled "PLRL - The internet equity layer", under a domain built as "claim" plus the brand-like token.
• Domain registered 2026-09-11 (about 0.11 years, or roughly 41 days old).
• Web archive holds only 4 snapshots, spanning 2026-09-11 to 2026-09-17, which shows a very recent and thin history.
• Behavioural sandbox, 3 of 3 runs successful: no external requests, no wallet-connect or drainer activity and no cloaking.

Regulatory Verification Notes

The analysis found no licence, registration number, legal-entity name or governance disclosure that ties the site to an accountable operator. The page-level disclosure picture is unclear, and both operational ownership and governance remain opaque. Registration through a commercial registrar and a technically valid certificate are baseline hygiene that any actor, including a malicious one, can obtain cheaply. They are not evidence of regulatory standing. Identity has not been independently verified, so the "PLRL" name cannot be treated as proof of any real-world brand or entity. No regulated status was established for any financial, token or equity-related activity the site implies. Evidence:

• Registrar of record is NICENIC International Group Co., Limited; registration runs to 2027-09-11.
• TLS certificate issued by YE2 (domain-validated only, so it confirms control of the domain, not the operator's identity), valid to 2026-12-10, with 48 days remaining.
• Hosting network identified as AS13335.
• Homepage: no operator name, licence reference or regulator reference identified.

What to Verify Next

The first step is to establish whether the real PLRL project, if one exists, has published this domain through its own officially announced channels, reached independently and not through links on this site or in the message that led to it. Any claim, airdrop or equity-style offer should be confirmed with the project's verified communication channels before anything is acted on. Any asserted licence or registration should be checked directly against the relevant regulator's public register. The security-vendor classification should be re-checked before any reassessment, and the source of the referral to this domain should be treated as potentially compromised. Evidence:

• Homepage: no named operator or licence that could be checked against a registry.
• Domain age: the domain is too new to carry independent reputation or an operating track record.
• Threat history: a phishing association is recorded for this domain.

Summary Verdict

The assessment is critical and elevated-risk. Confirmed external malicious classifications, a recorded phishing association and a very young, thinly documented domain converge on a clearly adverse posture. The sandbox's lack of overt malicious behaviour and a valid certificate do not change this outcome. The operator's real-world identity is unverified, and no positive evidence of an established entity offsets the threat findings.

Infrastructure Integrity

The site is fronted by Cloudflare, a mainstream CDN and WAF, on AS13335 in the United States. All observed addresses are edge servers and the origin host could not be seen, which prevents independent verification of where the content actually lives. The infrastructure is a minor mitigating factor, since it indicates a recognised provider and a valid certificate, but it cannot offset the reputation findings. Edge-only visibility also means the content can be swapped quickly without any visible infrastructure change. A young-domain, sparse-subdomain pattern is an unconfirmed heuristic and carries little weight beside the confirmed detections.

Closing Assessment

Read-only viewing, if needed at all, should be done from an isolated environment. Credentials should not be entered, wallets should not be connected, and no payments, transfers or "claim" actions should be made. Anything already submitted on this site should be treated as exposed, and passwords or wallet approvals should be changed or revoked immediately.