Is com-exchange-q-web3-chrome.com a scam? TrustSniffer's high-risk assessment: 12/100

Security Alert

Fortinet flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a near-empty single-page front end on a very recently registered domain. Its title reads "connect evm", and the only visible content is a short prompt, about forty characters long, that invites visitors to connect an Ethereum-compatible wallet. The domain name strings together exchange, web3 and browser-extension terms. Its apparent purpose is to funnel visitors into a wallet-connection step, but the page offers no product description, company narrative or service detail to show what the connection would be used for.

Scam/Impersonation Risk

The assessment is clearly cautionary. A confirmed blacklist-level detection exists: an external reputation check flags the domain, and a major security vendor classifies it as threatening. Two further engines rate it suspicious, and none rates it outright malicious. The domain name is built from generic exchange, web3 and browser-extension vocabulary rather than any single named brand. No specific brand impersonation or conflicting legal identity was observed. This naming pattern is nonetheless typical of lure domains that imitate wallet-connection or exchange flows. The homepage carries almost no substantive content, yet its only function is to solicit a wallet connection. A site that asks for a wallet link while presenting no operator, product or terms is positioned to exploit that link. The sandboxed browsing sessions found no wallet-drainer behaviour, clipboard tampering, hidden forms, cloaking or external data submission. That is a point in the site's favour, but it does not offset the external detections. A page with so little content may also be a staging shell whose behaviour could change after the initial captures. Evidence:

• The homepage presents only a "connect evm" title and a brief wallet-connection prompt, with no explanatory content, product description or operator information.
• Domain registered 2026-10-10, about 11 days before analysis (~0.03 years old).
• 3 archive snapshots, all from 2026-10-11 to 2026-10-13 (1 year tracked), so there is no prior history of legitimate use.
• External reputation checks return a blacklist-level hit, a tier-one vendor detection and two suspicious engine verdicts; no engine returned a malicious verdict.

Regulatory Verification Notes

The site publishes no legal, terms, privacy, about or licensing pages. Any financial or exchange-like activity implied by the domain name therefore has no stated regulatory status, registered entity or governing jurisdiction. This is a transparency gap and is not, by itself, evidence of wrongdoing. Here it compounds the confirmed external detections. Ownership and governance are opaque, and the operator's real-world identity could not be independently connected to any person or organisation. No third-party broker or regulator-style reputation record matched the domain. The registration is recent and made through the NICENIC International Group registrar. The site is served over a valid but entry-level encryption certificate. This confirms an encrypted connection and says nothing about the operator's legitimacy. Evidence:

• The homepage, the only page captured, contains no company name, registration number, licence reference or contact details.
• Registrar: NICENIC INTERNATIONAL GROUP CO., LIMITED; registration expires 2027-10-10.
• TLS certificate issued by YE2 (DV, domain validation only), valid to 2027-01-08 (78 days remaining at analysis).
• Served from AS13335 (CLOUDFLARENET, Cloudflare, Inc., US).

What to Verify Next

Before any interaction, the site's claimed purpose and operator should be established through channels independent of the site. The first step is to determine which exchange, wallet or service, if any, the domain claims to represent. That should be confirmed directly with the official provider, using a bookmarked address or an official app store listing rather than a link leading to this domain. If a regulated financial service is implied, its licence should be checked in the relevant national registry. The official support and contact channels should also be confirmed by an independent route. Any wallet that has already interacted with the site should be reviewed for granted permissions and token approvals, which should be revoked if present. Evidence:

• The homepage names no operator, so identity can only be checked externally.
• The domain's exchange, web3 and extension wording suggests a provider association that the page never states.
• The wallet-connection prompt on the homepage is the only interactive element, so token approvals are the main exposure.

Summary Verdict

The overall posture is high risk. Confirmed external threat detections and a brand-new, history-free domain with no identifiable operator converge on an assessment that is cautionary and security-forward. The clean sandbox behaviour and valid encryption are the only mitigating observations, and they are insufficient to alter that conclusion. Legitimacy cannot be considered established, and the operator's identity remains unverified.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and WAF, and all four observed addresses, two IPv4 and two IPv6, are edge servers on that network. The origin server was not observable. Edge-only visibility prevents independent verification of the true hosting location and makes it harder to detect rapid content changes behind the same address. Protective infrastructure is a mitigating factor only. It cannot offset the reputation risk and does not indicate that the operator is legitimate.

Closing Assessment

The site should be treated as unsafe for any sensitive interaction. Wallets should not be connected and no credentials, seed phrases, signatures or payments should be submitted. Any contact with the site should be limited to passive viewing in an isolated environment, and anything that appears to refer to it should be treated as suspect until the external detections are cleared.