Verdict
This assessment found strong scam indicators. Do not pay, sign in, or share personal details with this site.
motiontrading.app shows high-risk / scam indicators.
| What this site appears to be | Motion is a crypto trading automation ecosystem offering a browser extension, web Manager, and Telegram bot for trading on Solana, Ethereum, Base, and BSC. It charges a 1% trade fee and requires wallet connection to execute trades, while its large volume and user statistics and profit-screenshot testimonials cannot be verified from the page, which shows no legal identity or contact details. |
|---|
Evidence status and limitations
Evidence completeness: Not recorded
- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.
At a glance
The checks that decide most of this verdict.
| Malware engines | 11 flagged itVirusTotal | Risk |
|---|---|---|
| Google Safe Browsing | Not listedGoogle | Clear |
| Abuse reports on the host | 0% confidenceAbuseIPDB, 0 reports; shared hosting inflates reports | Clear |
| Domain age | 2 months oldMost scam domains are under a year old | Risk |
| Web archive | Archived since 20261 snapshot | Clear |
| Certificate | Encrypted connectionIssued by WE1 | Noted |
The page as captured
Key findings
- Automated classification: Sensitive Interaction Risk.
- Domain age: less than 1 year (registration continuity).
- Public web-archive history exists since 2026.
- At least one reputation service TrustSniffer consulted had flagged this domain at assessment time.
Full analysis
Security Alert
Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.
Motion, served from the domain motiontrading.app, is a single-page crypto trading automation landing site. It markets a browser extension that overlays existing trading terminals, a web "Manager" dashboard, and a Telegram trading bot, covering Solana, Ethereum, Base and BSC. Its apparent business model is a per-trade fee on every buy and sell executed through its tools, supplemented by referral and cashback programmes. Users must connect their own wallets so the platform can trade on their behalf.
Scam/Impersonation Risk
The assessment identifies confirmed contradictory signals. The domain is on a threat-intelligence blacklist, and several major security engines independently classify it as malicious. That convergence is decisive and carries the cautionary posture of this report. No brand impersonation and no conflicting legal identities were observed, and the sandbox saw no wallet-drainer routines, clipboard tampering or hidden forms. These observations do not offset the blacklisting. The homepage content adds to the concern. A looping ticker claims "28M+ transactions", "70,000+ active traders" and "$4.5B+ volume", sourced to "on-chain data, updated april 2026". Elsewhere the site cites a figure of 400,000+ users. It also asserts the platform is "non-custodial" and promises the "fastest fills in crypto". None of this is substantiated on the page, and the user figures are inconsistent with each other. The testimonials show large SOL profit screenshots, which cannot be verified. The visitor experience uses pressure mechanics: a forced notification modal, a friend-request popup, a "Sign up & Watch" gate, and trading locked behind a wallet connection. The 1% fee (0.9% for referred users) plus referral and cashback incentives create a recruitment-style incentive structure around a product that needs delegated trading authority over user funds. The domain's very recent registration, combined with claims of multi-billion-dollar volume, is a mismatch typical of manufactured credibility. Evidence:
- Homepage: a repeating statistics ticker claims 28M+ transactions, 70,000+ active traders and $4.5B+ volume, with no verifiable source beyond a generic "on-chain data" label.
- Homepage: testimonials with large SOL profit figures, a forced notification modal, a friend-request popup and a "Sign up & Watch" gate precede any substantive disclosure.
- Domain provenance: registered 2026-08-08 (~0.2 years old); the web archive holds 1 snapshot (2026, 1 year tracked), so no established history supports the scale claimed.
- Reputation: external threat-intelligence listing confirmed, with multiple security engines flagging the domain as malicious.
Regulatory Verification Notes
The homepage names no legal entity, registered address, terms of service, privacy policy, audit or regulatory status, and it claims no licence. It offers no contact details beyond a Telegram bot and channel, which is its only social presence. The site presents a financial-action service, delegated trading with user wallets, with none of the disclosures a regulated or accountable operator would normally publish. The real-world operator therefore remains unverified, and the site's "non-custodial" claim has no accompanying documentation or audit to support it. No third-party broker-reputation match exists for this name. The reputational concern here rests on the threat-intelligence listing discussed above. Evidence:
- Homepage: no company name, jurisdiction, address, licence or registration number, and no terms or privacy documentation is presented.
- Homepage: Telegram is the sole social and support channel (a bot and a channel link); no independent corporate presence is shown.
- Registered through PDR Ltd. d/b/a PublicDomainRegistry.com, 2026-08-08 to 2027-08-08.
- Served from AS13335 (Cloudflare, Inc., US); TLS certificate issued by WE1 (DV, domain-validated only), valid to 2027-01-05.
What to Verify Next
Before any interaction, the operator's existence should be established independently, through a registered legal entity and a verifiable jurisdiction. The "non-custodial" and volume claims need independent confirmation, such as a published security audit of the extension and bot, or on-chain analytics that match the stated figures. Official support and contact channels should be confirmed through an independent route rather than links on the site. Anyone who has already connected a wallet should review and revoke token approvals and permissions granted to this service. The extension and bot should not be installed until the listing is resolved. Evidence:
- Homepage: the "non-custodial" claim and the statistics ticker are unsupported by any linked audit or analytics source.
- Homepage: wallet-connection and password-creation forms are the entry point to the product.
- Telegram bot and channel: the only support route shown, and therefore not an independent source of verification.
Summary Verdict
The deterministic assessment places this site at the lowest trust tier, with an elevated, high-severity risk posture. Confirmed external threat detections, a very new domain, and an unverifiable financial service that asks for delegated wallet access converge into a consistent picture. The available evidence does not support treating the site as legitimate, and its technical hygiene is insufficient to change that conclusion.
Infrastructure Integrity
The site is fronted by Cloudflare, a trusted CDN and WAF. All four observed IP addresses are CDN edge servers, and the origin server was not observable. This protection is a mitigating factor only. It speaks to availability and basic hygiene, not to the operator's legitimacy, and edge-only visibility limits independent verification of the true hosting location. The TLS certificate is valid, but it is a domain-validated type that confirms control of the domain and nothing about the operator. Protective infrastructure cannot offset the confirmed reputation risk.
Closing Assessment
The site should be limited to read-only viewing. Account creation, password reuse, wallet connection, and the installation of its extension or Telegram bot should all be avoided, and no funds or token approvals should be committed to the service unless the threat-intelligence listing is withdrawn and the operator is independently identified.
Written analysis generated 2026-10-20 by the TrustSniffer Analysis Engine from the evidence in this report.
What the analysis found
4 findings contributed to this verdict, raised by external reputation, hosting and network, page content, history in the web archive.
01 External reputation
- An external threat feed lists this domain: either Google Safe Browsing marked it malicious, or a significant number of malware engines flagged it.External reputation
rule:EXT_BLACKLIST_CRITICAL
02 Hosting and network
- The domain was registered less than three months ago.Hosting and network
rule:DNS_NEW_DOMAIN_90D
03 Page content
- The page content shows three or more warning signs that deceptive sites commonly use.Page content
rule:PAGE_RED_FLAGS_STRONG - The page shows few of the signs expected from a trustworthy operator.Page content
rule:PAGE_TRUST_QUALITY_LOW - The page content shows at least one warning sign that deceptive sites commonly use.Page content
rule:PAGE_RED_FLAGS_SOME
04 History in the web archive
- The web archive has almost no record of this domain, which fits a site that is new.History in the web archive
rule:ARCH_PEN_YOUNG_AND_SPARSE
Identity verification
| Status | UNVERIFIED |
|---|---|
| Identity score | 55/100 |
| Identity verification confidence | 60% |
- No on-site identity signals detected
Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence.
What TrustSniffer observed
First-party facts recorded during the assessment of motiontrading.app.
- The request stayed on motiontrading.app. It was not redirected to another domain. Clear
- Registration is published under PDR Ltd. d/b/a PublicDomainRegistry.com. Clear
- DNS for this domain is served by cloudflare.com, across 2 name servers. Noted
- The registration is paid up to 2027-08-08. Noted
- The earliest public archive of this site is from 2026-10-11. Clear
- It is hosted on CLOUDFLARENET, from a server in US. Noted
Domain intelligence
| Registrar | PDR Ltd. d/b/a PublicDomainRegistry.com |
|---|---|
| Hosting | CLOUDFLARENET - Cloudflare, Inc., US |
| Country | US |
| Server IP | 2606:4700:3033::6815:9a0 |
| Name servers | ligia.ns.cloudflare.com, steven.ns.cloudflare.com |
| CDN / edge network | Detected (cloudflare) |
| Resolved IP addresses | 4 |
| Edge IP addresses | 4 |
| Likely origin IP addresses | 0 |
| SSL issuer | WE1 |
| SSL expiry | 2027-01-05 |
| Domain age | 0.20 years (continuous registration) |
| Domain expiry | 2027-08-08 |
| Archive first seen | 2026-10-11 |
| Archive snapshots | 1 |
| Reputation | VirusTotal: 11 flagged | AbuseIPDB: 0% confidence, 0 reports | Google Safe Browsing: 0 matches |
About this assessment
A trust score summarises the evidence TrustSniffer could collect about motiontrading.app at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.
TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.