Verdict
This assessment found strong scam indicators. Do not pay, sign in, or share personal details with this site.
lcaiclaim.com shows high-risk / scam indicators.
Evidence status and limitations
Evidence completeness: Not recorded
- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.
At a glance
The checks that decide most of this verdict.
| Malware engines | 5 flagged itVirusTotal | Risk |
|---|---|---|
| Google Safe Browsing | Not listedGoogle | Clear |
| Abuse reports on the host | 0% confidenceAbuseIPDB, 66 reports; shared hosting inflates reports | Clear |
| Domain age | 3 months oldMost scam domains are under a year old | Risk |
| Certificate | Encrypted connectionIssued by YR2 | Noted |
| Hosted by | AMAZON-02Server in US | Noted |
The page as captured
Key findings
- Automated classification: Sensitive Interaction Risk.
- Domain age: less than 1 year (registration continuity).
- At least one reputation service TrustSniffer consulted had flagged this domain at assessment time.
Full analysis
Security Alert
Fortinet, Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.
This website is a single-page destination titled "Lightchain — Claim $LCAI". It presents itself as a claim portal for a token called $LCAI, and the page carries only a very small amount of text. Its apparent purpose is to steer visitors into a token-claim or airdrop-style interaction. Nothing on the page ties it to a verified operator or to the project whose name it uses.
Scam/Impersonation Risk
The evidence converges on an elevated, clearly cautionary risk posture. Several independent security engines, including two tier-one vendors, currently flag the domain as malicious, and it is confirmed blacklisted by external threat intelligence. The domain was registered only a few months ago, so it has no meaningful operating history. The homepage is built around a "claim" call to action tied to a crypto token brand, a lure format commonly used to draw visitors into wallet connections, signature requests or credential entry. The domain name and page title mirror a named token project, but no link between this site and that project's genuine channels has been established. Automated behavioural testing observed no wallet-connection prompts, clipboard manipulation, hidden forms or outbound data submissions, and that is a mitigating observation. It does not offset the blacklist outcome, because a malicious flow can be activated or swapped in after testing. A separate set of abuse reports exists, but it applies to a shared provider address rather than to this domain specifically, so it is treated as discounted context, not as evidence against the site.
- Homepage: titled as a "Claim $LCAI" page, with minimal text and no accompanying product, company or support description.
- Domain registration: registered 2026-08-01 (~0.24 years old), which makes it a very recent domain.
- External reputation: five engines rated the domain malicious and one suspicious, including two tier-one vendors, which produced the confirmed blacklist hit.
- Behavioural testing: three of three sandbox runs completed with no external network activity, no wallet-connect events and no cloaking. 66 abuse reports against a shared provider address were attributed to shared infrastructure and discounted.
Regulatory Verification Notes
The homepage gives no operator name, legal entity, registration number, licence or jurisdiction, and the page text is too thin to support any identity claim. Real-world ownership is therefore unverified, and the available evidence does not allow the site to be treated as a legitimate or authorised distribution channel for the token it names. No third-party broker or regulatory listing was matched, which is neutral and not itself an adverse finding. The site offers a token-claim mechanic with no stated terms, risk disclosures or eligibility rules, and a financial interaction of that kind would normally be expected to publish them.
- Homepage: no legal entity, licence, registration reference or terms of use are presented.
- Registration record: the domain is registered through the registrar NETIM, with the registrant shown as privacy-redacted.
- Hosting: served from AS16509 (AMAZON-02, Amazon.com, Inc., US).
- Transport encryption: a domain-validated TLS certificate issued by YR2, valid to 2026-12-31. This confirms only an encrypted connection, not the identity of the operator.
What to Verify Next
Before any interaction, confirm through the token project's own official channels, reached independently of this site, whether a claim programme exists and whether it uses this domain. The official channels should be located by a route that does not start from this site or from any link, message or advertisement that led to it. Any request to connect a wallet, sign a message or enter a seed phrase on this domain should be treated as unauthorised until the project itself confirms it in writing. If the site was reached through an unsolicited message, social post or advertisement, the sender and the originating account should be checked and reported. Official contact and support channels should be confirmed independently before any exchange of information.
- Homepage: the claim call to action is the only substantive content, so any legitimacy of the offer rests entirely on external confirmation.
- External reputation: the current malicious detections mean no claim step on this domain can be considered validated.
- Registration record: the domain's recent creation date means any "established programme" assertion should be checked against the project's own published history.
Summary Verdict
The overall posture is high risk. Active malicious detections and a confirmed blacklist outcome outweigh the site's technically orderly setup, and a very young domain with a claim-themed lure page adds to that. Legitimacy is not supported, and the operator's real-world identity remains unverified.
Infrastructure Integrity
The site sits behind a Cloudflare CDN/WAF layer, and only a single edge address was observed, so the true origin server is not visible. This setup is a mitigating factor only. It adds some resilience and filtering, but it also prevents independent verification of where the content is actually hosted. Infrastructure protections cannot offset the external threat detections. Two automated heuristics point to a young domain with a thin infrastructure footprint, but these are unconfirmed and carry little weight against the stronger reputational evidence.
Closing Assessment
The site should be limited to read-only viewing at most. No login, no credentials, no wallet connection or signing, and no payments or token transfers should be attempted on this domain. Any link that led here should be treated as untrusted and reported to the platform where it appeared.
Written analysis generated 2026-10-27 by the TrustSniffer Analysis Engine from the evidence in this report.
What the analysis found
4 findings contributed to this verdict, raised by external reputation, hosting and network, behaviour in a sandbox, registration and ownership.
01 External reputation
- An external threat feed lists this domain: either Google Safe Browsing marked it malicious, or a significant number of malware engines flagged it.External reputation
rule:EXT_BLACKLIST_CRITICAL
02 Hosting and network
- The domain was registered less than three months ago.Hosting and network
rule:DNS_NEW_DOMAIN_90D - The hosting and network setup shows a moderate level of risk indicators.Hosting and network
rule:DNS_RISK_MED - The domain is young and has almost nothing else set up around it.Hosting and network
rule:DNS_SPARSE_YOUNG_DOMAIN
03 Behaviour in a sandbox
- Most of what the page loaded came from other domains rather than from this one.Behaviour in a sandbox
rule:BEHAV_EXTERNAL_RATIO_HIGH
04 Registration and ownership
- The registration record withholds contact details for the operator.Registration and ownership
rule:KF_WHOIS_HIDDEN
Signals weighed against the site
- AbuseIPDB: 66 reports on hosting IP 64.29.17.65 (Vercel, Inc, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.
Identity verification
| Status | UNKNOWN |
|---|---|
| Identity score | 50/100 |
| Identity verification confidence | 15% |
- AI page analysis unavailable (page captured; identity not AI-verified)
Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence.
What TrustSniffer observed
First-party facts recorded during the assessment of lcaiclaim.com.
- The request stayed on lcaiclaim.com. It was not redirected to another domain. Clear
- Registration is published under NETIM. Clear
- DNS for this domain is served by cloudflare.com, across 2 name servers. Noted
- The registration is paid up to 2027-08-01. Noted
- It is hosted on AMAZON-02, from a server in US. Noted
Domain intelligence
| Registrar | NETIM |
|---|---|
| Hosting | AMAZON-02 - Amazon.com, Inc., US |
| Country | US |
| Server IP | 64.29.17.65 |
| Name servers | FINLEY.NS.CLOUDFLARE.COM, LIZ.NS.CLOUDFLARE.COM |
| CDN / edge network | Detected (cloudflare) |
| Resolved IP addresses | 1 |
| Edge IP addresses | 1 |
| Likely origin IP addresses | 0 |
| SSL issuer | YR2 |
| SSL expiry | 2026-12-31 |
| Domain age | 0.24 years (continuous registration) |
| Domain expiry | 2027-08-01 |
| Archive first seen | Not available |
| Archive snapshots | Not counted (archive lookup incomplete) |
| Reputation | VirusTotal: 5 flagged | AbuseIPDB: 0% confidence, 66 reports | Google Safe Browsing: 0 matches |
About this assessment
A trust score summarises the evidence TrustSniffer could collect about lcaiclaim.com at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.
TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.