Is pciymarket.co a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

The website at pciymarket.co presents a very short interstitial page titled as a suspected-phishing warning in place of any storefront or product content. The material captured contains no products, pricing, claims or operator information. The site's apparent purpose and business model therefore cannot be established from its own content, and it carries active adverse external reputation signals.

Scam/Impersonation Risk

This is the decisive area of concern. The domain is blacklisted by multiple independent security engines. Several of them classify it as malicious, including two widely used enterprise-grade security vendors, and an automated kill-switch rule was triggered on that basis. Hostile detections of this breadth are rarely incidental, and the page captured at the homepage was itself a suspected-phishing interstitial, which is consistent with those detections. No conflicting legal identities and no specific brand-impersonation target were identified, and the detections do not say which brand or service, if any, the domain is meant to imitate. The reputational evidence alone is enough to treat the domain as hostile for any sensitive purpose. Behavioural testing across three runs found no wallet-connection prompts, wallet-drainer routines, clipboard manipulation, hidden forms or credential posts to outside parties. These findings do not offset the blacklisting. They only mean that no additional exploit mechanics were seen during the limited interaction possible with the page. Evidence:

• Homepage: multiple external security engines, including two top-tier vendors, flag the domain as malicious or suspicious, and no major search-safety listing is among them.
• Homepage: the only content captured was a short suspected-phishing interstitial, and the page title says so.
• Domain provenance: registered 2026-08-18 (~0.19 years old), with a single web-archive snapshot dated 2026-08-31 and one year tracked, so there is no meaningful prior history.
• Behavioural sandbox: heavy third-party request traffic (93 external XHR calls, 9 external POSTs, 16 console errors), all to recognised destinations, with no wallet or clipboard abuse observed.

Regulatory Verification Notes

No licensing or registration material could be associated with the domain. No operating company, regulator, licence number or registered address could be linked to it from the material reviewed, so the real-world operator's identity is unverified. This is a verification gap and not evidence of fraud on its own, but here it sits alongside the confirmed adverse detections and removes any mitigating assurance. No broker-reputation record matched the domain, so there is no third-party reputational context in either direction. Registration is through a mainstream registrar with a proxy privacy service, which is an administrative detail only. Evidence:

• Registered through Wild West Domains, LLC, with the registrant masked by Domains By Proxy, LLC; the registration runs to 2027-08-18.
• Transport encryption is a TLS certificate issued by WE1 at the domain-validated (DV) level, valid to 2027-01-14. DV only proves control of the domain, not the operator's identity.
• Served from AS13335 (Cloudflare, Inc., US).
• The site and its legal and identity pages contain no named legal entity, licence or registration number in the material reviewed.

What to Verify Next

Verification should be done independently of the domain. Anyone who arrived through an advertisement, message or referral should confirm through an offline route, directly with the organisation the link claims to represent, whether it operates under this domain. Any licence or registration claimed in connection with the site should be checked directly in the relevant public registry. Anyone who has already entered credentials or payment details on the domain should treat them as compromised and rotate them promptly. The domain's external listing status should be re-checked after any remediation announcement before the posture is revisited. Evidence:

• Homepage: the access request returned a restricted-access response (HTTP 403), so the site's own content could not be reviewed to support any claim.
• Identity assessment: the site could not be linked to a real-world brand or person.
• Domain age is under three months, so the registration history cannot corroborate any long-standing operator.

Summary Verdict

The domain presents an elevated, clearly adverse risk posture. Confirmed external threat detections dominate the assessment, and nothing in the evidence offsets them. The site's operator and purpose remain unestablished, and it should be treated as hostile for any sensitive interaction.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and WAF with bot-protection active, and all four observed addresses are CDN edge addresses. The origin server was not observable, so hosting cannot be verified independently. This protection is a mitigating factor only. It is shared by legitimate and malicious sites alike and does not offset the threat detections. An unconfirmed heuristic notes a young domain with sparse subdomains, but this was weighed as weak evidence and is not presented as a confirmed risk.

Closing Assessment

The domain should be avoided for login, credential entry, wallet connection and any payment or financial activity. At most it should be viewed passively from an isolated environment. Anything downloaded from it should not be opened, and any link leading to it should be reported to the platform or sender that supplied it.