Is mofipi.com a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Google, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

mofipi.com is a recently registered website whose homepage, at the time of analysis, was intercepted by an edge-network interstitial titled "Suspected Phishing" and returned an access-denied response. No product, service, or business content was presented to the visitor. Its apparent purpose and business model therefore cannot be established from the site's own content.

Scam/Impersonation Risk: Contradictory signals are present, and they are severe. The domain is blacklisted: a major browser-safety service flags it for social engineering, and a large number of independent security vendors classify it as malicious. Several leading vendors are among them. Together these detections triggered a hard override of the overall assessment, and nothing else in the evidence offsets them. The interstitial the visitor meets is itself a phishing warning, which fits these listings. No conflicting legal-entity names were observed, and no brand impersonation was confirmed. The risk comes from the reputation findings, not from identity inconsistency. The domain is also very young. Behavioral testing showed heavy outbound traffic: a large majority of requests and several POST submissions went to external destinations, and a high volume of script errors and large page-structure changes followed interaction. Testing did not observe wallet-drainer activity, clipboard hijacking, hidden forms, or external password forms, but these findings do not reduce the reputational risk.

Regulatory Verification Notes: No licensing, registration, or legal-entity information could be reviewed, because no legal, terms, or about content was accessible. The operator cannot be linked to any real-world organization or person. Registrant details are incomplete, which is ownership opacity and not an identity contradiction. This is a verification gap and is not scam evidence in itself. It does mean there is no independent anchor to counterbalance the hostile reputation findings. The site presents no regulated-entity status, and no third-party regulatory source supports one. The valid transport-encryption certificate is domain-validated only, which confirms control of the domain and nothing about the operator.

What to Verify Next: The first step is to establish why the domain is flagged and whether any organization legitimately operates it. Anyone who received this address through an invitation, advertisement, message, or QR code should confirm the sender's identity through an independent, offline route. They should not reach the site through the message that supplied it. If the site claims affiliation with a known brand or financial service, that claim should be checked against the brand's officially published channels, entered manually, and not through links or contact details found on this domain. If the domain belongs to the reader's own organization, it should be checked for compromise, and the listing owners should be asked to review it once any issue is remediated.

Summary Verdict: The overall posture is high-risk and clearly cautionary. Confirmed blacklist detections from independent security sources dominate the assessment, supported by the domain's youth, its unverifiable operator, and its heavy external traffic behavior. The evidence does not support treating the site as legitimate for any sensitive purpose.

Infrastructure Integrity: The site sits behind Cloudflare's CDN/WAF, with all observed addresses belonging to edge servers in the US and the origin address not exposed. A trusted-CDN presence and a valid certificate are mitigating factors only. They do not offset the reputation findings, and the edge-only visibility prevents independent confirmation of where the content is actually hosted.

Closing Assessment: The site should not be used for login, credential entry, payments, or any financial interaction, and nothing should be downloaded from it. Any contact with the domain should be limited to passive, read-only observation from a hardened environment. Anyone who has already entered credentials or made payments should change those credentials, notify the relevant institution, and report the domain to the relevant anti-phishing authorities.