Verdict
This assessment found strong scam indicators. Do not pay, sign in, or share personal details with this site.
phnxprotocol.live shows high-risk / scam indicators.
| What this site appears to be | Phoenix Protocol is a Genesis NFT mint (888 pieces, 0.018 ETH) tied to the $EMBER token, with Burn, Revive, Vaporize and staking mechanics. The page presents profitable Burn rewards and a future NFT-flipping treasury, requires wallet connection and transaction signing, and provides no verifiable contract address, team identity, audit or contact channel. Financial-transaction interaction with missing proof places it in the CRITICAL band. |
|---|
Evidence status and limitations
Evidence completeness: Not recorded
- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.
At a glance
The checks that decide most of this verdict.
| Malware engines | None flagged itVirusTotal | Clear |
|---|---|---|
| Google Safe Browsing | Not listedGoogle | Clear |
| Abuse reports on the host | 0% confidenceAbuseIPDB, 0 reports; shared hosting inflates reports | Clear |
| Domain age | 18 days oldMost scam domains are under a year old | Risk |
| Web archive | Archived since 20263 snapshots | Clear |
| Certificate | Encrypted connectionIssued by YE1 | Noted |
The page as captured
Key findings
- Automated classification: Sensitive Interaction Risk.
- Domain age: less than 1 year (registration continuity).
- Public web-archive history exists since 2026.
- No flags from the reputation services TrustSniffer consulted at assessment time.
Full analysis
Security Alert
Fortinet flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.
This website is a single-page NFT and token-launch landing site branded "Phoenix Protocol". It presents a closed "alpha group" Genesis NFT collection tied to a token called $EMBER. A visitor is asked to connect a crypto wallet, mint an NFT and take part in token-reward mechanics. The apparent business model is the sale of NFTs and tokens. As the page describes it, participant returns depend on new participants paying in rather than on a verifiable product.
Scam/Impersonation Risk
No confirmed listing on a security or reputation source, brand impersonation, phishing finding or conflicting legal identities was observed. The site is nonetheless clearly cautionary, because its content and behavior carry strong fraud-pattern indicators. The homepage sells a collection of 888 Genesis NFTs at a fixed mint price of 0.018 ETH and says 40 pieces are reserved for the team at a "symbolic price". It describes Burn, Revive and Vaporize mechanics, staking tiers, and a future treasury that would fund NFT flipping and token buybacks. It says proceeds are routed to Uniswap liquidity, and that holders earn minted or burn-funded $EMBER rewards. Because the page says rewards are paid from new mints and new payments, the structure appears to resemble a Ponzi-style payout model. This is an assessment of the described mechanics, not a verified finding about how the contracts behave. The page also calls its mechanics "transparent" and "on-chain", says membership is "governed by smart contracts, not promises", and advertises "$EMBER CLAIMS ARE LIVE". It gives no contract address, audit or team identity to support any of these claims.
The wallet flow adds to the concern. It offers a very broad multi-chain selector covering Trust Wallet, TronLink, WalletConnect, Bybit, Binance Web3, OKX, Bitget, Ledger, imToken and TokenPocket, among others. It shows prompts such as "Reload the page and verify a different wallet" and a "Manual Claim" fallback, which resemble patterns seen on wallet-draining pages. Our own behavioral testing recorded many outbound requests to non-approved third-party destinations, including a large number of external POST submissions, plus repeated console errors. These observations come directly from that testing, but the data does not show what was sent or why, so they indicate risk and do not prove misuse. A security vendor is also reported to have flagged the domain, and a second source rated it suspicious. The specific detections and their underlying sources were not specified, so these are treated as soft third-party warnings or reputation notes and given reduced weight. They are not a confirmed listing. Taken together with the content and behavior above, they are consistent with the elevated assessment, but they are not what the assessment rests on.
- Homepage: 888-piece Genesis mint at 0.018 ETH, with 40 pieces reserved for the team, and rewards funded by Burn and Revive activity and by new mints.
- Homepage wallet flow: a multi-wallet selector with "verify a different wallet" and "Manual Claim" prompts, and the claim that mechanics are "governed by smart contracts", with no contract reference shown.
- Browser behavior testing: 12 external POST requests, 9 to non-approved destinations, across 3 test runs.
- Domain provenance: registered 2026-09-30 (about 19 days old). The web archive holds 3 snapshots, all from 2026 (first 2026-09-30, last 2026-10-09), so there is no established history.
Regulatory Verification Notes
The site claims no license, regulator or registration number. It names no legal entity or operator, and the homepage publishes no team identity, audit report, physical address or contact channel. For a site that takes ETH payments and promises token rewards, these omissions are significant gaps in disclosure. They are not, on their own, proof of wrongdoing. Real-world operator identity remains unverified. Independent identity verification is low-scoring and low-confidence, and the on-page claims of transparency cannot be treated as evidence of it. No third-party broker or regulatory-database entry was matched. Nothing was found to offset the missing disclosures.
- Homepage: no license authority, license number, company name or jurisdiction is stated anywhere in the page content.
- Homepage: no contact channel, audit reference or named team members appear, despite financial-transaction calls to action.
- Registration: domain registered through NICENIC International Group Co., Limited, created 2026-09-30, expiring 2027-09-30.
- Transport encryption: TLS certificate issued by YE1 (DV, domain validation only), valid to 2026-12-29. This confirms encryption but does not confirm who operates the site.
What to Verify Next
Before any payment or wallet interaction, the project's claims need independent confirmation outside the site. Any contract address should be located through an official channel that can be validated independently, then inspected on a public blockchain explorer for verified source code, ownership and admin privileges, token holder concentration and the team allocation. The claimed on-chain mechanics should be compared with what the contracts actually do. Any named team or auditor should be confirmed through an independent, offline route. Official communication channels should be confirmed through sources not linked from this page.
- Homepage: the mint and claim flows depend on wallet connection and transaction signing, so contract-level inspection should come first.
- Homepage: roadmap claims about a treasury, buybacks and NFT flipping have no supporting documentation to test against.
- Domain history: the site has only weeks of existence, so no track record or prior community history exists to rely on.
Summary Verdict
The available evidence supports a clearly cautionary, elevated-risk assessment. Several fraud-pattern content signals converge on the same conclusion: a payment-first token and NFT model, unsupported claims, and unverified operator identity. A very recent domain and the soft third-party warnings, whose sources and details were not specified, add to that picture. The technical hygiene present does not offset it.
Infrastructure Integrity
The site is served through Cloudflare's CDN and WAF. All observed addresses are edge servers, and the origin server was not observable. This provides basic transport and availability protection and is a mitigating factor only. It says nothing about who operates the project. It also means the underlying hosting cannot be independently verified, and it can mask rapid content changes.
Closing Assessment
Prospective users should not connect a wallet, sign transactions or send funds until the project's contracts and operators have been independently verified. Viewing the page for information only is the proportionate limit of safe interaction in the meantime.
Written analysis generated 2026-10-20 by the TrustSniffer Analysis Engine from the evidence in this report.
What the analysis found
3 findings contributed to this verdict, raised by external reputation, page content, hosting and network.
01 External reputation
- Several malware engines flagged this domain.External reputation
rule:EXT_BLACKLIST_HIGH
02 Page content
- The review of the page content rated it high risk.Page content
rule:PAGE_RISK_HIGH - The page shows few of the signs expected from a trustworthy operator.Page content
rule:PAGE_TRUST_QUALITY_LOW - The page content shows three or more warning signs that deceptive sites commonly use.Page content
rule:PAGE_RED_FLAGS_STRONG
03 Hosting and network
- The domain was registered less than three months ago.Hosting and network
rule:DNS_NEW_DOMAIN_90D
Identity verification
| Status | UNVERIFIED |
|---|---|
| Identity score | 30/100 |
| Identity verification confidence | 50% |
- No on-site identity signals detected
Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence.
What TrustSniffer observed
First-party facts recorded during the assessment of phnxprotocol.live.
- The request stayed on phnxprotocol.live. It was not redirected to another domain. Clear
- Registration is published under NICENIC INTERNATIONAL GROUP CO., LIMITED. Clear
- DNS for this domain is served by cloudflare.com, across 2 name servers. Noted
- The registration is paid up to 2027-09-30. Noted
- The earliest public archive of this site is from 2026-09-30. Clear
- It is hosted on CLOUDFLARENET, from a server in US. Noted
Domain intelligence
| Registrar | NICENIC INTERNATIONAL GROUP CO., LIMITED |
|---|---|
| Hosting | CLOUDFLARENET - Cloudflare, Inc., US |
| Country | US |
| Server IP | 2606:4700:3030::ac43:ada5 |
| Name servers | stevie.ns.cloudflare.com, bryce.ns.cloudflare.com |
| CDN / edge network | Detected (cloudflare) |
| Resolved IP addresses | 4 |
| Edge IP addresses | 4 |
| Likely origin IP addresses | 0 |
| SSL issuer | YE1 |
| SSL expiry | 2026-12-29 |
| Domain age | 0.05 years (continuous registration) |
| Domain expiry | 2027-09-30 |
| Archive first seen | 2026-09-30 |
| Archive snapshots | 3 |
| Reputation | VirusTotal: 0 flagged | AbuseIPDB: 0% confidence, 0 reports | Google Safe Browsing: 0 matches |
About this assessment
A trust score summarises the evidence TrustSniffer could collect about phnxprotocol.live at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.
TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.