Is greenmorning.fun a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a single-page, Finnish-language imitation of the Google search and consent interface. It shows a cookie and data-consent dialog, a "click here if the redirect does not activate" notice, and navigation to Gmail, image search, sign-in, AI image-creation tools and a long list of language options. Its apparent purpose is to look like a familiar search portal on an unrelated, newly registered domain. The page itself asks for no payments, passwords or seed phrases.

Scam/Impersonation Risk

The assessment is clearly cautionary. A security vendor in the top tier has flagged the domain as malicious, and other engines marked it suspicious, which amounts to a confirmed external blacklist hit. The page also reproduces the layout, wording and service navigation of a globally recognised search brand, and the domain name is a lookalike of that brand's registered domain. Nothing on the domain links it to that brand. A brand interface on an unrelated, days-old domain with a threat-intelligence listing is a recognised staging pattern for credential harvesting and redirect-based abuse. The visible text contains no credential prompt, but the "redirect does not activate" notice means the page's purpose is to send visitors elsewhere. The destination was not captured, so the page could be swapped to a harvesting form or a hostile redirect without notice. Browser behaviour is consistent with this: the page generated heavy external network traffic, a high share of synthetic responses and repeated console errors. All external requests went to destinations classed as benign, so these are indicators of an unstable or staged page, not proof of malicious activity. No conflicting legal identities appear, because the page presents no legal or corporate identity at all. Evidence:

• Homepage: Google-branded search box, Gmail and image-search links, and a Finnish consent dialog on a domain unrelated to that brand.
• Homepage: the redirect-fallback notice indicates an automatic forward to an undisclosed destination.
• Threat intelligence: one top-tier vendor reports the domain as malicious and two others as suspicious; an external blacklist flag is set.
• Domain provenance: registered 2026-10-06 (about 13 days old); 2 archive snapshots, both captured 2026-10-07, so there is effectively no history.

Regulatory Verification Notes

The site makes no regulatory claims. The page has no terms, privacy policy, about page, company name, registration number or contact route, so nothing can be tied to a named operator or accountable legal entity. The consent dialog and the "Terms" and "Privacy" labels visible in the page text reproduce the mimicked brand's footer and do not establish any disclosure by this domain's operator. No third-party broker or regulator record matched this domain. Because the site presents itself as a free search tool with no financial offer, licensing is not the central issue. The absence of any identity disclosure is the relevant gap, and it compounds the reputational concerns above. Evidence:

• Homepage: no legal, ownership or support information is presented anywhere on the captured page.
• Registration: domain registered through NICENIC International Group Co., Limited, created 2026-10-06 and expiring 2027-10-06.
• Hosting: served from AS13335 (Cloudflare, Inc., US).
• Transport security: TLS certificate is domain-validated only, issued by YE2, valid to 2027-01-04. This confirms encryption but says nothing about who operates the site.

What to Verify Next

Anyone who reached this page through a link, message or advertisement should treat that link as untrusted and leave without interacting. The genuine search service should be reached only by typing its official address or using a bookmark, not by following links to this domain. Security teams should look for the referral source, such as the email, ad or message that carried the link, and check whether other lookalike domains were registered at the same time. Any credentials already entered on this domain should be treated as exposed and reset on the genuine service. The remaining open question is the redirect target, which should be examined only in an isolated analysis environment. Evidence:

• Homepage: the redirect-fallback notice means the final destination is not shown in the captured content.
• Threat intelligence: the listing is current, and the detection details were not specified in more detail.
• Domain age: registered about 13 days before the assessment, so no track record exists to rely on.

Summary Verdict

The overall posture is high risk. A confirmed external blacklist hit, a brand-mimicking interface on an unrelated and very new domain, and the lack of any accountable operator identity converge on a site that should be treated as untrusted. The harmless appearance of the visible page content does not offset these convergent indicators.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and WAF, and every observed address is a CDN edge node. The true origin server is not observable, so hosting cannot be independently verified and content could be changed behind the edge without notice. Bot protection is active, and the infrastructure is mainstream and free to obtain. It is a mitigating factor only and does not offset the reputation risk: the same service is available to any registrant, and the sparse subdomain footprint fits a freshly stood-up site.

Closing Assessment

Treat the site as untrusted. Do not sign in, enter credentials or make any payment on it, and limit any contact to read-only inspection from an isolated environment. Report the domain to the relevant security team or abuse channel if it arrived through unsolicited communication.