Is getkeyflow.art a scam? TrustSniffer's high-risk assessment: 0/100

Overview

The website at getkeyflow.art is a newly established, near-empty landing page titled "KeyFlow". It presents only a few characters of visible text, with no readable description of products, pricing, team or business purpose. Its function and business model therefore cannot be established from the site's own content. The page does load scripts that detect browser wallet providers and sends a moderate share of its network requests to external services, which is the only indication of its intended use.

Scam/Impersonation Risk

Contradictory signals are present and decisive. Several independent security engines currently flag the domain as malicious, and it also appears on an external blacklist. This confirmed blacklisting drives the elevated-risk assessment. No conflicting legal entities and no brand impersonation were observed, but the site's own content offers nothing to offset the reputation damage. The homepage gives a visitor no legitimate-business context, such as an operator, product description or support channel, against which the warnings could be weighed. Browser testing was reassuring on some points. Repeated sessions showed no wallet-draining routines, no clipboard hijacking, no hidden or credential-harvesting forms, no cloaking and no fingerprinting. The page does contain wallet-provider detection logic, which is common on sites meant to prompt wallet connections. Combined with the blacklist hits and the domain's age, that makes any wallet-connect or sign-in prompt on this site a serious exposure for users. The absence of observed malicious behavior in a limited test does not outweigh the external detections. Operator identity could not be independently connected to any real-world person or brand. Evidence:

• Homepage: the title is "KeyFlow", with only a trivial amount of text and no product, pricing or company information.
• Domain reputation: multiple security engines mark the domain malicious or suspicious, and it also appears on an external blacklist. Search-engine safe-browsing checks did not flag it.
• Domain provenance: registered 2026-08-09 (~0.21 years old), with 3 archive snapshots spanning 2026-09-11 to 2026-09-22 (1 year tracked), so there is almost no operating history.
• Browser sessions (3 of 3 completed): wallet-provider code detected, but no drainer, clipboard or hidden-form activity. About a quarter of requests went to external hosts, though none to unrecognized destinations.

Regulatory Verification Notes

The site publishes no legal, terms, privacy or about content that could be assessed, so there is no named operating entity, jurisdiction, licence or registration reference to examine. Whether the site is meant to offer financial or wallet-related services cannot be determined from what it shows. No broker-reputation dataset match exists for the name, so there is no third-party regulatory context either way. The domain was registered through the registrar Gname.com Pte. Ltd. with the registrant details withheld. This is treated as an administrative matter, not as a separate contradiction. The site's transport encryption is valid but is only a domain-validated certificate. It confirms an encrypted connection and says nothing about who operates the site. Evidence:

• Legal and identity pages: none were observable, and the homepage names no operator or jurisdiction.
• Hosting: served from AS13335 (Cloudflare, Inc., US).
• Transport encryption: TLS certificate issued by WE1 (DV), valid to 2027-01-05.
• Registration: registrar Gname.com Pte. Ltd., with an expiry of 2027-08-09, which is a one-year term.

What to Verify Next

Any claim of affiliation or authorization should be checked through an independent, offline route before any interaction. If the site is presented as a product, service or wallet tool, its existence and official domain should be confirmed with the claimed vendor, preferably through channels not linked from this site. Any claimed licence should be checked directly with the relevant registry. The current blacklist and detection status should be rechecked after the owner has had time to respond, because a listing can be lifted if the site is cleaned or its use clarified. Official support channels should be confirmed independently. Evidence:

• Homepage: it names no operator, regulator or registry that could be confirmed.
• Domain age: the domain is only a few months old, so there is no prior track record to rely on.
• Reputation listings: the current listings are the principal reason for rechecking status before any further engagement.

Summary Verdict

The overall posture is high-risk and cautionary. Confirmed reputation listings, a very young domain and a content-free page leave no evidence of legitimacy that could offset the warnings. The technical hygiene observed in testing is acceptable but does not change this conclusion.

Infrastructure Integrity

The site is fronted by Cloudflare's CDN and WAF. All four observed addresses are Cloudflare edge servers on AS13335, and the origin server was not observable, so independent verification of the actual hosting is not possible. This arrangement is a mitigating factor only. It can also mask rapid content changes and does not offset the external threat detections.

Closing Assessment

The site should not be used for login, credential entry, wallet connection, or any payment or financial transaction. At most, it should be viewed read-only from an isolated environment. Anyone who has already interacted with it should treat any shared credentials as exposed and revoke any wallet approvals.