Is icmd77.top a scam? TrustSniffer's high-risk assessment: 5/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a single-page, English-language travel site on a low-cost ".top" domain. Its homepage carries a short editorial piece titled "Travel: where to stay in Paris". It presents itself as a lightweight travel-advice page and shows no storefront, account area, or product catalogue. Its commercial purpose is not stated on the page.

Scam/Impersonation Risk

The page contains hard contradictions. Several major security vendors currently flag the domain as malicious, and a broader set of detection engines independently agrees. Combined, these amount to a confirmed blacklist condition. A travel-advice page is a typical low-suspicion front. Such pages are often used to host redirects, payload delivery, or lure content that differs by visitor or over time, so the benign homepage text does not offset the reputation findings. No conflicting legal entities appear on the site, and no brand impersonation was confirmed. The risk therefore comes from the external threat listings, not from identity inconsistency. In controlled sandbox sessions the homepage loaded stably, made no calls to outside domains, showed no hidden forms, wallet prompts, or clipboard manipulation, and did not alter its content after interaction. That is a mitigating observation about the page as captured, but it does not cancel the active listings. The listings are the decisive signal. Evidence:

• Homepage and domain reputation: three tier-one security vendors flag the domain as malicious. In total, 16 detection engines return malicious verdicts and 2 return suspicious verdicts.
• Homepage behaviour: three sandbox runs all returned HTTP 200 with zero external requests, zero console errors, and no cloaking.
• Domain provenance: registered 2025-11-03 (~1 year old), so the domain has no long track record to counterbalance the detections.

Regulatory Verification Notes

The captured homepage is brief and discloses no operator, company name, licence, or registration number. The domain's registration details are also incomplete, which is consistent with ownership opacity. Because of this, the real-world operator cannot be independently tied to the site, and none of the site's claims can be treated as verified. No third-party broker or regulator profile matched this domain. The absence of licensing information is a transparency gap, not evidence of fraud on its own. It matters here only because the reputation findings above already point to elevated risk. Evidence:

• Homepage: roughly 435 characters of text, with no legal entity, address, or licence reference.
• Registration: registrar is NICENIC International Group Co., Limited. The domain expires 2026-11-03, and ownership details are incomplete.
• Hosting and encryption: served from AS200019 (AlexHost, Romania). The TLS certificate is DV-level, issued by YE2 and valid to 2027-01-06. This confirms an encrypted connection, not operator identity.

What to Verify Next

Before any engagement, the listing status should be rechecked with the flagging security vendors, and the owner of the domain should be asked for a clean-up or false-positive confirmation. If the domain is reached through a partner, referral, or email, that source should be confirmed through an independent, offline channel. Any claim that the site belongs to a known travel or hospitality business should be confirmed on that business's own official website, reached by manual navigation, not through links on this page. Any official support or contact channels should also be confirmed independently. Evidence:

• Reputation: the current malicious verdicts are the key item to recheck, and they should be tracked until they are delisted.
• Homepage: it names no operator or affiliation that could be cross-checked.
• Domain: the registration is under one year old, so no long-term ownership record exists to consult.

Summary Verdict

Available evidence supports an elevated-risk, clearly cautionary posture. Active, multi-vendor malicious listings override the technically clean sandbox behaviour and the valid encryption certificate. The operator's identity remains unverified, so no legitimacy conclusion can be drawn.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and WAF, and the only observed address is a CDN edge address. The true origin server is not visible. This is a mitigating factor only. It provides transport and availability protection, but it limits independent hosting verification and can mask rapid content swaps. It does not offset the external threat detections.

Closing Assessment

The site should be treated as read-only at most, and preferably avoided. Do not log in, enter credentials, make payments, or download files from it until the security listings are cleared and the operator is independently verified. Anyone who has already interacted with it should scan their device and rotate any credentials they entered.