Is ionet.forum a scam? TrustSniffer's high-risk assessment: 3/100

Security Alert

Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

ionet.forum is a marketing and product landing page for an AI infrastructure and GPU cloud service. It presents itself as io.net, "The Open Source AI Infrastructure Platform". It offers on-demand NVIDIA GPU clusters and virtual machines at published hourly rates, along with AI model and workflow tooling. A wallet-connection control and a promoted token rewards campaign sit beside the compute offering. The apparent business model is pay-as-you-go compute rental, with a secondary token-incentive layer.

Scam/Impersonation Risk

The domain is blacklisted by external threat-intelligence sources. Several independent security engines classify it as malicious, and one of them is a tier-one vendor. A confirmed blacklist hit like this is a decisive contradiction. Nothing in the site's polished presentation can offset it. The page also carries brand-lookalike signals. Its domain is a recently created variant that borrows the io.net name, and it also resembles a major cloud provider's short domain. Neither signal is confirmed as impersonation. However, the site's claim to be io.net cannot be tied to the genuine operator, so it must be treated as unverified.

The page content adds friction rather than reassurance. The homepage makes unsubstantiated comparative claims: H100 capacity "from $2.19/hr vs AWS at $12.29/hr", "Save up to 70%" and "Most startups save $10k+ monthly". It also asserts "Trusted by top AI startups" without naming any customer. A banner promotes a "$IO Compounding Interest Rewards Season" with no rate, mechanics, lock-up terms or risk disclosure. The token's role in the platform economy is never explained, and a "Connect Wallet" control sits in the main navigation. Together these form an opaque value-flow pattern. Pricing that looks attractive, undefined compounding rewards and a wallet prompt on a freshly registered, blacklisted lookalike domain match the usual lure structure of wallet-drain and prepayment fraud. Automated interaction with the page did not trigger wallet-drainer behaviour, clipboard hijacking, hidden forms or credential-harvesting forms. That reduces the likelihood of an immediate drain, but it does not clear the site. Sandbox runs also recorded heavy outbound traffic, several POST requests to destinations outside the expected set, a final-destination mismatch and thousands of page mutations after interaction.

Regulatory Verification Notes

The homepage shows SOC2 and GDPR badges, legal footer links, and a corporate name ("io.net, inc."). These on-site statements do not independently connect this domain to that company. The site claims no financial or other regulatory license, and the evidence does not show it needing one for compute rental. The token rewards program is a different matter, because its terms, jurisdiction and eligibility are undisclosed. No third-party broker or regulator record matched this domain, so no external reputational context is available. The domain is registered through Dynadot with a privacy service. That is an administrative detail and not an independent concern.

What to Verify Next

The first step is to establish whether this domain is operated by the genuine io.net. Compare it with the address reached by typing the official domain by hand or following a link from a trusted, independently sourced profile, not from this site or any message that pointed to it. The security badges and the "trusted by" claim should be checked against an issued compliance report and named customers. Before any wallet interaction, the $IO rewards terms should be obtained from the official project documentation. The official support and contact channels should also be confirmed through an independent route.

Summary Verdict

The overall posture is clearly cautionary and high-risk. Confirmed external threat detections decide the assessment, and a credible-looking product page cannot offset them. Apparent legitimacy and identity both remain unestablished, and the site is not suitable for sensitive interaction.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and WAF, and all observed addresses are edge nodes, so the origin server was not observable. A valid DV TLS certificate and mainstream edge infrastructure are mitigating factors only. They are widely available to any registrant and cannot offset the threat detections. Edge-only visibility also means hosting cannot be independently verified, and content could be swapped without detection. The young domain with sparse DNS footprint is an unconfirmed heuristic and adds no independent weight.

Closing Assessment

The site should be treated as read-only at most. No one should log in, connect a wallet, enter credentials, make payments or take part in the rewards program through this domain. Anyone seeking the genuine service should reach it through a manually typed or independently verified official address.