Is jeanphil.vip a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

The website jeanphil.vip is a single-page, token-themed landing site. Its page title, styled like a cryptocurrency ticker, presents a "Jean Phil" brand alongside a "$JEANPHIL" symbol. The captured homepage carries only a short block of text, so its apparent purpose is promotion of a branded digital-asset or community-token project, though the page content does not clearly establish a product or business model.

Scam/Impersonation Risk

This site carries a confirmed adverse reputation signal from external threat intelligence. A major security vendor flags the domain, and additional scanning engines classify it as suspicious. The detections are not specified by category, so the exact nature of the threat (phishing, malware or other abuse) is not established. Together they constitute a blacklist-level contradiction and the decisive factor in this assessment. The domain is also only a few weeks old and has almost no independent history, so no track record offsets the detections. No brand impersonation and no conflicting legal identities were observed, and sandboxed browsing of the homepage did not reproduce any wallet-connection prompts, hidden forms, cloaked content or off-site data submissions. One behavior is worth noting. A clipboard write was detected during page execution. No hijacking of copied data was observed, but token-themed sites commonly use clipboard actions to hand visitors a wallet or contract address, so any address obtained this way should never be trusted without independent confirmation. Evidence:

• Homepage: externally flagged by a major security vendor and by additional engines as suspicious, while the page's own behavior in the sandbox showed no off-site network activity.
• Domain registration: created 2026-10-02 (~19 days old, 0.05 years) through NICENIC International Group Co., Limited.
• Web archive: 3 snapshots, all between 2026-10-03 and 2026-10-08, so only one year is tracked and no meaningful history exists.
• Homepage behavior: a clipboard write was detected, with no clipboard hijacking, wallet-drainer activity or cloaking observed across 3 successful sandbox runs.

Regulatory Verification Notes

The captured homepage is brief and identifies no operating company, registration number, regulator or licensing status. For a site using a token ticker as its brand, this is a verification gap, not proof of wrongdoing by itself. Any third-party reputational signals here are warnings, and none amounts to a legal or licensing finding. The site's transport encryption is valid but is a basic domain-validated certificate, which confirms only an encrypted connection, not the operator's identity or legitimacy. Evidence:

• Homepage: no company name, licence, registry reference or jurisdiction appears in the captured page text, which is under 900 characters.
• Transport encryption: TLS certificate issued by YE1 (DV), valid to 2026-12-31 with 70 days remaining.
• Hosting: served from AS13335 (Cloudflare, Inc., US).

What to Verify Next

Before any engagement, the operator should be identified through channels independent of the site itself, such as a registered company search or official announcements from a source the visitor already trusts. If the site claims a token or financial offering, the claimed asset and any contract address should be checked against an independent blockchain explorer and not copied from the page. Whether the domain remains listed by threat-intelligence sources should be re-checked later, since the current detections may reflect either genuine abuse or a short-lived classification of a new domain. Any licensing claim made later should be confirmed directly with the relevant regulator's public register. Evidence:

• Homepage: the brand and ticker presented in the page title cannot be tied to a verifiable real-world entity from the captured content.
• Threat-intelligence status: the adverse detections are current as of this analysis and have no clarifying category.

Summary Verdict

The posture is clearly cautionary. A confirmed external threat signal combined with a very recently created domain and no independent track record leaves the site's legitimacy unestablished, and the available evidence does not support treating it as a trustworthy destination. Its technically ordinary behavior in the sandbox does not outweigh these findings.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and WAF, and all observed addresses are CDN edge servers, so the origin host cannot be seen. This protection is only a mitigating factor. It gives the site a normal, stable delivery layer and a valid certificate, but it offers no evidence of legitimacy. It also prevents independent hosting verification and can mask rapid content changes behind the same edge addresses. The sparse subdomain footprint typical of a freshly launched domain is an unconfirmed heuristic and carries little weight.

Closing Assessment

The site should be treated as read-only at most. Visitors should not log in, enter credentials, connect a wallet, make payments, or act on any addresses or offers found on the page until its operator and the cause of the external detections are independently resolved.