Is mefai-migrate.xyz a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

MEFAI Terminal, served from a migration-branded domain, is a crypto market-intelligence website. It shows live-looking token tickers, an economic calendar, news, academy articles and an AI-themed dashboard. Its main call to action is a "Connect Wallet" prompt to "migrate your MEFAI" tokens, alongside paid PRO and PRIME analytics and signal tiers. Its apparent business model combines subscription access to trading tools with a wallet-based token migration flow. The site does not identify who runs it or explain how the migration works.

Scam/Impersonation Risk

The signals here converge toward a high-risk posture. Several independent threat-intelligence engines currently flag the domain as malicious or suspicious, and one tier-one security vendor is among them. This amounts to a confirmed blacklist listing, which is the decisive factor. It is reinforced by the nature of the homepage's central action, which asks visitors to link a crypto wallet to move tokens. The page gives no migration terms, no mechanics, no audit link beyond a menu heading and no named counterparty. This is a claim-versus-evidence gap on a high-stakes financial action. The ticker strip shows more than thirty tokens, including established assets such as PancakeSwap's CAKE and Trust Wallet's TWT beside obscure micro-cap tokens. It also contains the PRO and PRIME paid tiers. These borrowed-credibility cues, together with polished live-looking data, do not substitute for any proof of who is behind the offer. The domain's name pairs the project's name with the word "migrate" on a very new registration, which is a pattern commonly used in token-migration lures. No brand impersonation, conflicting legal identities or phishing form was positively identified, and the automated browser sessions saw no external data exfiltration or wallet-drainer behaviour. Those observations do not offset the blacklist listing, because wallet-draining logic can be served selectively or introduced later. Evidence:

• Homepage: the primary call to action is a wallet connection to "migrate" MEFAI tokens, with no stated terms, contract references or audit documentation.
• Homepage: the ticker strip lists over thirty tokens, and the PRO and PRIME tiers are offered without pricing basis, operator or performance evidence.
• Domain provenance: registered 2026-09-22 (~0.07 years, about 27 days old), so the site has essentially no operating track record.
• Reputation: multiple threat-intelligence sources currently report the domain as malicious or suspicious, while the hosting network itself has no abuse reports.

Regulatory Verification Notes

The site presents no legal entity, company address, registration number, licence claim or regulator reference. This is a disclosure gap in the site's own content. It is especially significant because the site solicits wallet access and sells trading-signal products, activities that normally come with identifiable operators and published terms. No migration terms, privacy policy or contact channel was identified in the captured content, and the homepage links to no independent audit report. No third-party broker or regulatory-database match exists for the site. The absence of a match is neutral and gives no comfort. The site's very recent registration and negligible archive history also mean there is no prior record of the project operating under this domain. These gaps add to the reputational warnings above but are not a standalone finding of fraud. Evidence:

• Homepage and navigation: no operator name, jurisdiction, licence or registration reference appears anywhere in the captured content.
• Web archive: only 2 snapshots, both captured on 2026-09-22 (1 year tracked), so no earlier history exists.
• Registrar: NICENIC INTERNATIONAL GROUP CO., LIMITED, with registration running to 2027-09-22.
• Technical posture: served from AS13335 (Cloudflare, Inc., US); the TLS certificate is DV-level, issued by YE1 and valid to 2026-12-21, which confirms encryption but not operator identity.

What to Verify Next

Any claim of a MEFAI token migration should be checked against the official project's channels, reached through independently sourced routes rather than links on this site. These include the project's established website, its verified social accounts and its official announcements. The project team should be asked directly whether this domain is theirs and whether any migration is actually under way. Any contract addresses mentioned should be compared against the project's published contracts on a public block explorer. Official support and contact channels should also be confirmed through an independent route. Any operator or licensing claim should be confirmed with the relevant registry before any engagement. Subscription offers should not be paid for until the operator is identified. Evidence:

• Homepage: the migration call to action cites no contract address, snapshot date or migration deadline that can be cross-checked.
• Homepage: no named team, company or audit report is presented to support the paid analytics tiers.
• Threat intelligence: the active malicious listings mean the domain should be treated as untrusted until the listing is formally cleared.

Summary Verdict

The overall posture is high-risk and cautionary. Active third-party threat detections, a very recent registration and a high-stakes wallet-linked offer with no verifiable operator converge to define it. The site's polished presentation and standard transport encryption do not change that conclusion.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and WAF, and every observed address is a Cloudflare edge server. The origin server is not observable, so independent verification of the underlying hosting is not possible. Cloudflare's bot-protection layer was active during the automated visits. This is a mitigating factor only. It shows that the site is competently fronted, but the same service is used by legitimate and abusive sites alike. It cannot offset the reputational warnings, and the edge-only view also makes it harder to detect rapid content swaps behind the same domain.

Closing Assessment

The site should be limited to passive viewing at most. No wallet should be connected, no credentials entered, no funds moved and no subscription purchased. Anyone who has already interacted with it should immediately review and revoke any token approvals granted, move assets to a fresh wallet if there is any doubt, and report the experience to the official project.