---
title: "Is jeanphil.vip a Scam? Trust Score 0/100"
source: TrustSniffer
type: Website trust & fraud report
subject: "jeanphil.vip"
verdict: "Critical Risk"
title: "Is jeanphil.vip a Scam? Risk Report, Score 0/100"
trust_score: 0
classification_confidence: 70
canonical_url: https://trustsniffer.com/report/jeanphil.vip
assessed: 2026-10-22
---

# Is jeanphil.vip a scam? TrustSniffer's high-risk assessment: 0/100

## Verdict


**Verdict: Critical Risk, trust score 0/100.** jeanphil.vip shows high-risk / scam indicators.

This assessment found strong scam indicators. Do not pay, sign in, or share personal details with this site.

Labels: Sensitive Interaction Risk, Governance Risk

Assessed 2026-10-22 by automated analysis. Classification confidence 70%.

## Evidence status and limitations


Evidence completeness: Not recorded

- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.

## At a glance

The checks that decide most of this verdict.

| Check | Result | Status |
| --- | --- | --- |
| Malware engines | None flagged it (VirusTotal) | Clear |
| Google Safe Browsing | Not listed (Google) | Clear |
| Abuse reports on the host | 0% confidence (AbuseIPDB, 0 reports; shared hosting inflates reports) | Clear |
| Domain age | 18 days old (Most scam domains are under a year old) | Risk |
| Web archive | Archived since 2026 (3 snapshots) | Clear |
| Certificate | Encrypted connection (Issued by YE1) | Noted |

## The page as captured


![Screenshot of the jeanphil.vip homepage captured during the TrustSniffer assessment](https://trustsniffer.com/outputs/jeanphil.vip/screenshots/first.png)

_What jeanphil.vip served when TrustSniffer captured it on 2026-10-22. The page may look different now._

## Key findings


- Automated classification: Sensitive Interaction Risk.
- Domain age: less than 1 year (registration continuity).
- Public web-archive history exists since 2026.
- No flags from the reputation services TrustSniffer consulted at assessment time.

## Full analysis


### Security Alert

Fortinet flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

The website jeanphil.vip is a single-page, token-themed landing site. Its page title, styled like a cryptocurrency ticker, presents a "Jean Phil" brand alongside a "$JEANPHIL" symbol. The captured homepage carries only a short block of text, so its apparent purpose is promotion of a branded digital-asset or community-token project, though the page content does not clearly establish a product or business model.


### Scam/Impersonation Risk

This site carries a **confirmed adverse reputation signal** from external threat intelligence. A major security vendor flags the domain, and additional scanning engines classify it as suspicious. The detections are not specified by category, so the exact nature of the threat (phishing, malware or other abuse) is not established. Together they constitute a blacklist-level contradiction and the decisive factor in this assessment. The domain is also only a few weeks old and has almost no independent history, so no track record offsets the detections. No brand impersonation and no conflicting legal identities were observed, and sandboxed browsing of the homepage did not reproduce any wallet-connection prompts, hidden forms, cloaked content or off-site data submissions. One behavior is worth noting. A clipboard write was detected during page execution. No hijacking of copied data was observed, but token-themed sites commonly use clipboard actions to hand visitors a wallet or contract address, so any address obtained this way should never be trusted without independent confirmation. Evidence:

- Homepage: externally flagged by a major security vendor and by additional engines as suspicious, while the page's own behavior in the sandbox showed no off-site network activity.
- Domain registration: created 2026-10-02 (~19 days old, 0.05 years) through NICENIC International Group Co., Limited.
- Web archive: 3 snapshots, all between 2026-10-03 and 2026-10-08, so only one year is tracked and no meaningful history exists.
- Homepage behavior: a clipboard write was detected, with no clipboard hijacking, wallet-drainer activity or cloaking observed across 3 successful sandbox runs.

### Regulatory Verification Notes

The captured homepage is brief and identifies no operating company, registration number, regulator or licensing status. For a site using a token ticker as its brand, this is a verification gap, not proof of wrongdoing by itself. Any third-party reputational signals here are warnings, and none amounts to a legal or licensing finding. The site's transport encryption is valid but is a basic domain-validated certificate, which confirms only an encrypted connection, not the operator's identity or legitimacy. Evidence:

- Homepage: no company name, licence, registry reference or jurisdiction appears in the captured page text, which is under 900 characters.
- Transport encryption: TLS certificate issued by YE1 (DV), valid to 2026-12-31 with 70 days remaining.
- Hosting: served from AS13335 (Cloudflare, Inc., US).

### What to Verify Next

Before any engagement, the operator should be identified through channels independent of the site itself, such as a registered company search or official announcements from a source the visitor already trusts. If the site claims a token or financial offering, the claimed asset and any contract address should be checked against an independent blockchain explorer and not copied from the page. Whether the domain remains listed by threat-intelligence sources should be re-checked later, since the current detections may reflect either genuine abuse or a short-lived classification of a new domain. Any licensing claim made later should be confirmed directly with the relevant regulator's public register. Evidence:

- Homepage: the brand and ticker presented in the page title cannot be tied to a verifiable real-world entity from the captured content.
- Threat-intelligence status: the adverse detections are current as of this analysis and have no clarifying category.

### Summary Verdict

The posture is clearly cautionary. A confirmed external threat signal combined with a very recently created domain and no independent track record leaves the site's legitimacy unestablished, and the available evidence does not support treating it as a trustworthy destination. Its technically ordinary behavior in the sandbox does not outweigh these findings.


### Infrastructure Integrity

The site sits behind Cloudflare's CDN and WAF, and all observed addresses are CDN edge servers, so the origin host cannot be seen. This protection is only a mitigating factor. It gives the site a normal, stable delivery layer and a valid certificate, but it offers no evidence of legitimacy. It also prevents independent hosting verification and can mask rapid content changes behind the same edge addresses. The sparse subdomain footprint typical of a freshly launched domain is an unconfirmed heuristic and carries little weight.


### Closing Assessment

The site should be treated as read-only at most. Visitors should not log in, enter credentials, connect a wallet, make payments, or act on any addresses or offers found on the page until its operator and the cause of the external detections are independently resolved.


_Written analysis generated 2026-10-22 by the TrustSniffer Analysis Engine from the evidence in this report._

## What the analysis found

5 findings contributed to this verdict, raised by external reputation, hosting and network, history in the web archive, behaviour in a sandbox, registration and ownership.

### 01 External reputation
- Several malware engines flagged this domain. (External reputation `rule:EXT_BLACKLIST_HIGH`)

### 02 Hosting and network
- The domain was registered less than three months ago. (Hosting and network `rule:DNS_NEW_DOMAIN_90D`)
- The domain is young and has almost nothing else set up around it. (Hosting and network `rule:DNS_SPARSE_YOUNG_DOMAIN`)

### 03 History in the web archive
- The web archive has almost no record of this domain, which fits a site that is new. (History in the web archive `rule:ARCH_PEN_YOUNG_AND_SPARSE`)

### 04 Behaviour in a sandbox
- A large share of what the page loaded came from other domains. (Behaviour in a sandbox `rule:BEHAV_EXTERNAL_RATIO_MODERATE`)

### 05 Registration and ownership
- The registration record withholds contact details for the operator. (Registration and ownership `rule:KF_WHOIS_HIDDEN`)

## Identity verification


| Field | Value |
| --- | --- |
| Status | UNKNOWN |
| Identity score | 50/100 |
| Identity verification confidence | 15% |

- AI page analysis unavailable (page captured; identity not AI-verified)

_Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence._

## What TrustSniffer observed

First-party facts recorded during the assessment of jeanphil.vip.

- The request stayed on jeanphil.vip. It was not redirected to another domain. (Clear)
- Registration is published under NICENIC INTERNATIONAL GROUP CO., LIMITED. (Clear)
- DNS for this domain is served by cloudflare.com, across 2 name servers. (Noted)
- The registration is paid up to 2027-10-02. (Noted)
- The earliest public archive of this site is from 2026-10-03. (Clear)
- It is hosted on CLOUDFLARENET, from a server in US. (Noted)

## Domain intelligence


| Field | Value |
| --- | --- |
| Registrar | NICENIC INTERNATIONAL GROUP CO., LIMITED |
| Hosting | CLOUDFLARENET - Cloudflare, Inc., US |
| Country | US |
| Server IP | 2606:4700:3037::6815:4b95 |
| Name servers | seth.ns.cloudflare.com, colette.ns.cloudflare.com |
| CDN / edge network | Detected (cloudflare) |
| Resolved IP addresses | 4 |
| Edge IP addresses | 4 |
| Likely origin IP addresses | 0 |
| SSL issuer | YE1 |
| SSL expiry | 2026-12-31 |
| Domain age | 0.05 years (continuous registration) |
| Domain expiry | 2027-10-02 |
| Archive first seen | 2026-10-03 |
| Archive snapshots | 3 |
| Reputation | VirusTotal: 0 flagged \| AbuseIPDB: 0% confidence, 0 reports \| Google Safe Browsing: 0 matches |

## About this assessment


**Was this report useful?** Tell other people what you think of TrustSniffer, good or bad. An honest review helps others decide whether to rely on these checks. [Review TrustSniffer on Trustpilot](https://www.trustpilot.com/review/trustsniffer.com)

A trust score summarises the evidence TrustSniffer could collect about jeanphil.vip at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.

TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.

## Related on TrustSniffer
- [05599.vip](https://trustsniffer.com/report/05599.vip), another .vip site assessed as critical-risk (Critical Risk, 0/100)
- [00808.vip](https://trustsniffer.com/report/00808.vip), another .vip site assessed as critical-risk (Critical Risk, 0/100)
- [pay2world.vip](https://trustsniffer.com/report/pay2world.vip), another .vip site assessed as critical-risk (Critical Risk, 0/100)
- [viptradesignal.vip](https://trustsniffer.com/report/viptradesignal.vip), another .vip site assessed as critical-risk (Critical Risk, 0/100)
- [defilending-pool.vip](https://trustsniffer.com/report/defilending-pool.vip), another .vip site assessed as critical-risk (Critical Risk, 11/100)
- [yeetokens.vip](https://trustsniffer.com/report/yeetokens.vip), another .vip site assessed as critical-risk (Critical Risk, 0/100)
- [gprosol.vip](https://trustsniffer.com/report/gprosol.vip), another .vip site assessed as critical-risk (Critical Risk, 0/100)
- [crimecat.vip](https://trustsniffer.com/report/crimecat.vip), another .vip site assessed as critical-risk (Critical Risk, 0/100)
- [sendusdt-2.vercel.app](https://trustsniffer.com/report/sendusdt-2.vercel.app), another site assessed as critical-risk (Critical Risk, 5/100)
- [voting-mefai-net.pages.dev](https://trustsniffer.com/report/voting-mefai-net.pages.dev), another site assessed as critical-risk (Critical Risk, 21/100)
- [Every website and wallet TrustSniffer has assessed](https://trustsniffer.com/directory), the full risk directory
- [Other domains assessed as high-risk or phishing](https://trustsniffer.com/directory/phishing-domains), same verdict band
- [Check another website](https://trustsniffer.com/web-intelligence), run a new assessment
- [Check a crypto wallet address](https://trustsniffer.com/on-chain-risk), on-chain screening
- [The TrustSniffer Risk Index](https://trustsniffer.com/stats), how this verdict compares

## Guides
- [Connect a Wallet to a Scam Site: What Happens](https://trustsniffer.com/blog/connect-wallet-to-a-scam-site-what-happens)
- [Stablecoin Freezes, Oct 24, 2026: 15 Wallets](https://trustsniffer.com/blog/stablecoin-freeze-report-2026-10-24)
- [Fake Airdrop Sites Show a Number, Not a Transfer](https://trustsniffer.com/blog/fake-airdrop-sites-show-a-number-not-a-transfer)

---
*Source: [TrustSniffer](https://trustsniffer.com/report/jeanphil.vip) — independent automated trust & fraud analysis. Cite as https://trustsniffer.com/report/jeanphil.vip · assessed 2026-10-22.*