Is gunicorn.xyz a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

The website at the gunicorn.xyz domain does not present a normal site to visitors. Automated visits reach a security interstitial, served with an access-denied status, whose title identifies the destination as suspected phishing. Only a short block of text sits behind the challenge, so no product, brand, or business model could be established. Its apparent purpose cannot be reliably determined, and the available evidence points to a very recently created domain that has been flagged by threat-intelligence sources.

Scam/Impersonation Risk

This is a confirmed blacklisting scenario. Several independent reputation sources currently classify the domain as malicious or suspicious, and a major security vendor is among those flagging it. The site's own delivery layer displays a suspected-phishing warning in place of content. These signals converge with a domain created only weeks earlier, so the domain's short history gives no counterweight to the detections. In behavioural testing, the page loaded a very large share of its resources from third-party origins. It issued dozens of background requests and several outbound POST submissions to those origins, and it produced a heavy burst of console errors and DOM mutations after interaction. The testing did not observe wallet-drainer activity, clipboard hijacking, hidden forms, or credential posts to external hosts. Those absences do not offset the blacklist and phishing findings. No conflicting legal identities or brand impersonation were identified, because no identity pages were observable. The risk rests on reputation and behaviour rather than on identity contradictions. A site that is actively flagged as phishing and is so new should be treated as a credential-harvesting or fraud-staging candidate until cleared by the listing sources. Evidence:

• Homepage capture: the page title reads as a suspected-phishing warning, and the request was blocked with a 403 status after a bot challenge.
• Domain registered 2026-08-15 (~0.19 years, about 71 days old) with Global Domain Group LLC as registrar.
• Multi-engine reputation scan: 3 malicious and 2 suspicious verdicts, including a tier-1 security vendor, plus a confirmed external blacklist hit.
• Behavioural sandbox, three runs: 70 external XHR/fetch calls, 9 external POSTs, up to 97.2% of activity directed externally, 25 console errors, and 1,523 DOM mutations after interaction.

Regulatory Verification Notes

No licensing, registration, or legal-entity disclosure could be assessed, because the only content reachable was the warning interstitial and a short text fragment. No terms, privacy, about, or contact pages were observable, so no regulatory standing can be inferred in either direction. No third-party broker or regulator-database record matched this domain. The site's state is therefore that of an unvetted, very new web property. Its legitimacy cannot be established from on-site claims, and the real-world operator is not independently verified. The valid transport encryption is a baseline hygiene signal only. It says nothing about who operates the site or whether it is lawful. Evidence:

• TLS certificate issued by WE1 (DV, domain validation only), valid to 2027-01-12, with 77 days remaining at analysis time.
• Served from AS13335 (Cloudflare, Inc., US).
• No legal, licensing, or contact content was reachable on the homepage capture.

What to Verify Next

Before any engagement, the current status of the domain should be re-checked with the listing sources that flag it. Only a documented delisting or a vendor-confirmed false positive would justify revisiting the assessment. Any organisation claiming to operate this domain should be asked for its legal entity name and licensing details, and those details should be validated through the relevant public registry rather than through links or addresses supplied by the site. If the domain arrived via an unsolicited message, advertisement, or redirect, the sender should be verified through an independent channel and the message reported. Organisations whose users may have visited it should review proxy and DNS logs for connections to this domain. Evidence:

• The domain was created about 71 days before analysis, so no long-term reputation record exists to rely on.
• Reputation detections are current and unresolved at the time of analysis.
• The homepage exposes no verifiable operator identity.

Summary Verdict

The overall posture is high risk. Active threat detections, a suspected-phishing designation, and the lack of any established history outweigh the technically sound transport security. Legitimacy cannot be inferred, and the site should be treated as a likely vehicle for credential theft or fraud until independent delisting shows otherwise.

Infrastructure Integrity

The domain resolves entirely to Cloudflare edge addresses in the US, and the origin server could not be observed. The protection is real but is a mitigating factor only, and it cannot offset the reputation risk here. Edge-only visibility prevents independent confirmation of where the content is actually hosted. The bot-challenge layer that blocked the capture is standard for such services, and it also means the underlying content could change without visible signs. The domain's age combined with sparse subdomain structure is an unconfirmed heuristic that fits a newly stood-up property.

Closing Assessment

The site should not be used for login, credential entry, or any financial interaction, and nothing should be downloaded from it. Any link to it should be treated as hostile and reported to the person or channel that supplied it. At most, passive viewing from an isolated environment is acceptable, pending independent delisting.