Is nxpro.art a scam? TrustSniffer's high-risk assessment: 0/100

Overview

The website at the domain nxpro.art is a newly established single-page site titled "NXPRO". Its homepage presents almost no readable content beyond the brand name, with no description of products, services, company or business model. Its apparent purpose cannot be determined from the visible content.

Scam/Impersonation Risk

Contradictory signals are present and are the decisive factor in this assessment. Multiple independent threat-intelligence engines currently flag the domain as malicious or suspicious, and it is blacklisted by external reputation sources. A prior phishing association is also recorded against it. No conflicting legal entities and no brand impersonation were observed. The homepage offers too little content to show what the site claims to be, so the blacklisting stands as the main evidence, and it cannot be offset by any legitimate business context. Behavioral testing was less concerning but does not change the conclusion. Repeated runs showed no cloaking, hidden forms, clipboard manipulation, wallet-draining activity or external password submission. The homepage did trigger a moderate volume of third-party requests, though none went to unrecognized destinations, and a wallet-provider component was detected without any connection attempt being exercised. These behaviors are non-confirming and do not mitigate the blacklist. Evidence:

• Homepage: the visible text is only a few characters long, consisting of the brand name, with no product, company or contact information.
• Domain registration: registered in 2026 (~0.12 years, ~44 days old), through Gname.com Pte. Ltd.
• Web archive: 2 snapshots in total, spanning 2026-09-17 to 2026-09-22 (1 year tracked), so there is no meaningful history.
• Homepage behavior: 13 external XHR requests across 3 successful test runs, none to non-whitelisted destinations, and no wallet-connect or drainer activity.

Regulatory Verification Notes

The site publishes no legal, terms, privacy or about content. No operating company, licence or registration number is disclosed, and no third-party regulatory source confirms the site as regulated. This is a verification gap rather than evidence of misconduct in itself, but it leaves nothing to counter the reputational findings. The real-world operator has not been independently connected to the site. The registrant organization field holds a non-descriptive phrase, not a recognizable legal entity name, so it gives no identity anchor. No broker-reputation dataset matched the domain. Evidence:

• Homepage: no legal entity name, licence, registration number or regulator reference is published.
• Registration record: owner details are privacy-redacted, and the organization field is not a recognizable company name; registration expires 2027-09-08.
• Hosting: served from AS13335 (Cloudflare, Inc., US).
• Transport encryption: TLS certificate issued by WE1 (DV, domain validation only), valid to 2026-12-07 with 45 days remaining. A valid certificate confirms encryption only, not operator identity.

What to Verify Next

Any engagement should be preceded by identifying who operates the site, by independent means. Check the claimed operator against official company and financial-regulator registries. If the site is presented as a service or platform, confirm its existence and official domain through channels that do not rely on the site itself, such as the operator's established public presence or a direct offline contact route. Confirm any official support or contact channels in the same way. Treat any link, advertisement or message that directed a visitor to this domain as unverified until its origin is confirmed. Evidence:

• Homepage: it offers no verifiable company, product or contact detail to check against external sources.
• Reputation: the current threat-intelligence flags should be re-checked against the relevant reputation sources before any interaction.
• Domain lifecycle: the very recent registration means no long-standing independent record of the site exists.

Summary Verdict

The overall posture is high-risk. The domain is under active external threat flagging and has no established history or verifiable identity, while a technically valid but basic transport setup does not change that. The evidence supports a clearly cautionary stance.

Infrastructure Integrity

The site is fronted by Cloudflare, a major CDN and WAF provider, and all four observed addresses are edge servers. The origin server is not visible, so hosting cannot be verified independently, and edge-only visibility can obscure rapid content changes. The infrastructure is a mitigating factor only. It is not proof of legitimacy and cannot offset the reputation risk.

Closing Assessment

The site should be limited to passive, read-only viewing, if it is visited at all. Credentials, account sign-in, wallet connections and any financial or personal-data submission should be avoided. Any download should be treated as unsafe until the external threat flags are cleared and the operator is independently verified.