Is multiplifoundation.net a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

Multipli Foundation is a single-page token-sale website at multiplifoundation.net. It is titled "Multipli Sale — Presale MULT Tokens & Airdrop" and offers a presale of MULT tokens together with an airdrop promotion. It carries very little text, so it works as a promotional landing page for a crypto token distribution. Its apparent business model is to collect participation in a token presale and airdrop. A purchase would be a financial interaction.

Scam/Impersonation Risk

This site carries a confirmed adverse reputation. It is blacklisted, with several independent threat-intelligence sources currently flagging it. The detections include multiple security engines reporting it as malicious and others as suspicious. Three tier-one security vendors are among those flagging it. That convergence is the decisive factor in this assessment. Nothing in the evidence shows brand impersonation or conflicting legal identities, and the site does not name another organisation. The risk therefore rests on the blacklisting itself and on the typical presale-and-airdrop pattern, which depends on urgency and on visitors handing over funds or wallet access. Browser-sandbox testing found no wallet-connection prompts, wallet-drainer behaviour, clipboard manipulation, hidden forms or content cloaking. These are mitigating observations only and do not offset the reputation findings. The homepage did make a notable volume of calls to external destinations, and a share of those went to unrecognised third-party services. Some of them were data submissions. That is consistent with outside tracking or sale-related integrations and cannot be accepted as benign given the blacklisting. Evidence:

• Homepage: titled as a MULT token presale and airdrop, with minimal on-page text.
• Reputation checks: multiple engines report the domain as malicious, including three tier-one vendors, and an external blacklist also lists it.
• Domain registration: created 2026-08-09, about 0.21 years (~77 days) old, expiring 2027-08-09, registered through PDR Ltd. d/b/a PublicDomainRegistry.com.
• Browser sandbox, homepage: 17 external XHR/fetch requests, 8 of them to non-whitelisted destinations, and 3 external POST submissions. No wallet-connect, drainer, clipboard-write or hidden-form activity was observed.

Regulatory Verification Notes

No regulator or licensing body was matched to this site, and no third-party broker record exists for it. The homepage does not clearly present a legal entity, registration number or licence for the token offering. A token presale is a financial-promotion activity, and nothing in the available evidence indicates it is authorised. This is a verification gap, not proof of wrongdoing on its own. The site's transport encryption is a valid certificate, which shows only that the connection is encrypted. It says nothing about the operator's legitimacy. Evidence:

• Homepage: no clearly identified legal entity or licence reference attached to the presale offer.
• TLS certificate issued by WE1 (DV, domain-validated only), valid to 2027-01-13.
• Served from AS13335 (Cloudflare, Inc., US).

What to Verify Next

Independent confirmation of the operator's identity is the first step. Any entity named in the project's official materials should be checked against company registries and the financial-promotion or crypto-asset authorisations of the relevant jurisdiction. The token's existence, contract details and sale terms should be confirmed through channels reached independently of this domain, such as established market-data listings or the project's verified announcements. Official support and contact channels should likewise be confirmed through an independent, offline route rather than links on this site. Any follow-up with the blocklisting parties can establish whether the listing is a false positive. If the domain is re-assessed, it should happen only after those parties have reviewed it. Evidence:

• Homepage: presale and airdrop claims with no verifiable operator or licensing reference.
• The domain's short registration history leaves no earlier track record to rely on.
• Multiple independent reputation sources currently flag the domain, so any remediation claim should be confirmed with them directly.

Summary Verdict

The available evidence places this website at critical risk. External threat detections dominate, and the site's newness and its presale-and-airdrop framing compound them. The real-world operator identity has not been independently established, and no positive indicator is strong enough to offset the confirmed reputation findings.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and WAF, and every observed address is a Cloudflare edge address. The origin server was not observable. The domain's DNS also shows a young, sparsely populated profile, flagged as a heuristic only. Cloudflare's protections are a mitigating signal for transport and availability. They do not verify the operator, and they do not offset the reputation findings. Edge-only visibility also means the site's content can be changed quickly without any visible change in hosting.

Closing Assessment

The site should be treated as read-only at most. Wallets should not be connected, transactions should not be signed, and no funds, credentials or personal data should be submitted. Any wish to take part in the token sale should be redirected to channels verified independently of this domain.