Is fun-tokencreator.live a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

A recently registered website whose homepage carries the title "bǐngwǔ (丙午) - pump" and whose domain name, fun-tokencreator.live, points to a token-creation or "pump"-style launchpad service. The homepage is a single page with a moderate amount of text, and the available evidence does not describe a product, fee schedule or operator, so the exact business model is not established. Sites in this niche typically involve token minting, trading or speculative promotion, which makes the page's purpose a security-relevant question.

Scam/Impersonation Risk: Hard contradictions are present. Several major security engines currently flag the domain as malicious or suspicious, and an independent blacklist listing is confirmed. These detections are specific to this domain and are not explained by shared infrastructure. The reputation checks on the shared network address are clean, which confirms the problem sits with the site and not with its hosting neighbours. No brand impersonation and no conflicting legal identities were observed. The risk therefore rests on the confirmed reputation listings, compounded by a very young domain that has had little time to build any record of legitimate operation. In controlled homepage visits, no wallet-connection prompts, clipboard tampering, hidden forms, credential posts to third parties, or cloaking were detected. That absence does not offset the threat listings, because malicious behaviour on sites of this kind is often activated only after a user engages. A large share of the page's resource loading comes from external origins, which adds to the need for caution. Evidence:

Regulatory Verification Notes: The evidence does not establish any financial licence, corporate registration or named legal entity for this site, and no third-party broker or regulator listing was matched. Because the site's function appears to involve crypto-asset creation or trading, the absence of any regulatory standing is relevant context. It is a verification gap and is not by itself proof of wrongdoing. Domain ownership is opaque, so no real-world operator can be tied to the site. The identity-verification status remains unknown, and nothing on the site should be read as proof of who runs it. The transport certificate is a basic domain-validated one, which confirms encrypted transport only and says nothing about the operator. Evidence:

What to Verify Next: Until the reputation listings are cleared, any engagement should be limited to passive viewing. Anyone with a business reason to deal with the site should ask the operator for its legal entity name, jurisdiction and any licence or registration number. These should be checked directly with the relevant regulator's public register. Official support and contact channels should be confirmed through an independent route, such as the official social accounts of a verified project. The domain should be re-checked against current threat-intelligence listings after any announced remediation, and a delisting should be treated as meaningful only if it comes with an explanation. Tokens or links promoted by the site should not be treated as endorsed by any established project. Evidence:

Summary Verdict: The site carries an elevated, clearly cautionary risk posture. Confirmed reputation listings, a very young domain and an unestablished operator identity converge on a conclusion that its apparent legitimacy cannot be relied upon. The absence of observed exploit behaviour in testing does not change that overall assessment.

Infrastructure Integrity: The site is fronted by Cloudflare's CDN and WAF (AS13335, US), and all four observed addresses are Cloudflare edge servers, so the origin server was not observable. This provides standard availability and transport protection and is a mitigating factor only. Edge-only visibility prevents independent hosting verification and can mask rapid content changes, and the protection cannot offset the reputation risk established above.

Closing Assessment: The site should be treated as unsafe for any login, credential entry, wallet connection or financial transaction until the threat listings are cleared and the operator is independently identified. At most, it should be viewed passively from an isolated, non-sensitive environment.

• Homepage reputation: multiple security vendors, including several tier-one names, flag the domain, and an independent blacklist listing is confirmed.
• Domain provenance: registered 2026-08-01 (~0.24 years old), so the domain is only about three months old.
• Archive history: a single archive snapshot (2026-08-04), spanning one year tracked, which matches a newly created site and gives no earlier history to rely on.
• Homepage behaviour across three sandbox runs: no wallet, clipboard, hidden-form or external-submission activity observed.
• Registration: the domain was registered through NICENIC International Group Co., Limited, and the owner details are incomplete.
• Transport encryption: the TLS certificate was issued by WE1 at the domain-validation (DV) level, with no organisation validation.
• Third-party broker intelligence: no match found, so there is neither an endorsement nor a negative broker signal.
• Certificate lifecycle: the certificate is valid until 2026-12-28 (about 62 days remaining), so its renewal is an early point at which the site's stability can be checked.
• Domain term: the registration runs to 2027-08-01, a one-year term that is the minimum for a newly created domain.
• Homepage: no operator identity, licence or entity name was established, so independent confirmation has to come from outside the site.