Is metaproapp.xyz a scam? TrustSniffer's high-risk assessment: 12/100

Overview

Metapro (metaproapp.xyz) is a newly launched Web3 gaming platform. Its landing page markets a non-custodial wallet that hosts in-wallet mini-games and apps, a games launcher for Windows, web, iOS, macOS, Android and Linux, and a marketplace for games and tradable gaming assets. It also offers developers a Unity SDK, wallet-integration and blockchain-data tools, and advertising services. The apparent business model is to monetise a gaming ecosystem through asset trading, developer tooling and advertising.

Scam/Impersonation Risk

The assessment is cautionary. A third-party threat-intelligence engine currently flags the domain as malicious, and a second engine rates it suspicious. This is a confirmed blacklist signal and the only contradiction observed. No phishing activity, brand impersonation or conflicting legal identities were found. The homepage has no login or data-capture forms, and the behavioural sandbox saw no external posts, no hidden forms, no wallet-drainer or clipboard-hijack behaviour and no cloaking across three runs. The listing therefore reads as a reputational red flag, not as proof of malicious page behaviour. It may also reflect the domain's extreme newness. It still outweighs the clean behaviour, because the site asks visitors to download a wallet and trade assets, which are actions where a wrong trust decision costs real money. The site's superlatives, such as "the world's first non-custodial explorer for mini apps and games within a wallet" and "the first choice omnichannel gaming platform", cannot be verified. The only showcased product is a pilot mini-game called "Degens Club", which is a thin basis for an ecosystem pitch. No yield or return promises appear on the page. Evidence:

• Homepage and domain reputation: one external engine reports the domain as malicious and another as suspicious, and the contradiction logic treats this as a confirmed blacklist.
• Domain registered 2026-10-07 (about 12 days old), via NameCheap, Inc., expiring 2027-10-07.
• Web archive holds 3 snapshots from 2026-10-07 to 2026-10-15, so the history is limited to the domain's first days.
• Homepage behaviour: zero forms, zero external network activity and no console errors in three successful sandbox runs.

Regulatory Verification Notes

The homepage gives no legal identity beyond a copyright line. It names no operating company, registered address, registration number or licence. The page analysis independently flags this as an unverifiable legal status. That is a disclosure gap, not evidence of wrongdoing, but it matters here because the site promotes asset trading and a custodial-adjacent wallet experience. The page does not explain the terms, fees or value flow of asset trading. No third-party broker or regulator record was matched. Discord, X and LinkedIn presences are referenced, and these provide some basis for identity linkage, but they do not amount to verified corporate identity. Evidence:

• Homepage footer: the copyright notice is the sole identity artefact, with no entity name, address or licence reference.
• Homepage "Trade Assets" and marketplace sections: no description of fees, custody of traded assets or dispute handling.
• Hosting on AS22612 (Namecheap, Inc., US), with a TLS certificate issued by SSL.com TLS Issuing RSA CA R1 (DV), valid to 2027-04-23.

What to Verify Next

Before any engagement, the operating legal entity should be established through independent company-registry searches, and it should be confirmed whether the entity holds any licence required for digital-asset trading in its jurisdiction. The official wallet download location and social accounts should be confirmed through channels independent of this site, such as links published by a known project or exchange, to rule out a lookalike distribution. The domain's reputation listing should be rechecked against the original reporting engines for details and for any later delisting. The official support and contact channels should be confirmed through an independent route. Evidence:

• Homepage: social links to Discord, X and LinkedIn are present, and their account age and follower authenticity are unconfirmed.
• Homepage wallet download and "Launcher" entries: the destination and publisher of the installable software are not described on the page.
• Reputation listing: the domain is currently flagged by external engines, and its delisting status is unknown.

Summary Verdict

The available evidence supports an elevated-risk posture. The site presents a coherent and professionally described product concept with benign observed page behaviour. However, a current threat-intelligence listing, a domain only days old with almost no operating history, and an absence of verifiable corporate identity together prevent any assessment of established legitimacy. The site's real-world operator is likely connected to its stated brand, but that link is not verified.

Infrastructure Integrity

The site is served from a single IP address on Namecheap's US network. No CDN or WAF fronting was detected, so the infrastructure adds no meaningful protective buffer. The TLS certificate is valid and issued by a recognised authority, but it is domain-validated only. That confirms an encrypted connection, not the operator's identity. The infrastructure looks like that of a very young domain with a sparse subdomain footprint, and it does not offset the reputation risk.

Closing Assessment

Read-only viewing of the public landing page is the only use consistent with the current evidence. Sign-in, credential entry, wallet connection, software installation and any transfer of funds or assets should wait until the threat listing is cleared and the operating entity is independently confirmed.