---
title: "Is phnxprotocol.live a Scam? Trust Score 0/100"
source: TrustSniffer
type: Website trust & fraud report
subject: "phnxprotocol.live"
verdict: "Critical Risk"
title: "Is phnxprotocol.live a Scam? Risk Report, Score 0/100"
trust_score: 0
classification_confidence: 75
canonical_url: https://trustsniffer.com/report/phnxprotocol.live
assessed: 2026-10-20
---

# Is phnxprotocol.live a scam? TrustSniffer's high-risk assessment: 0/100

## Verdict


**Verdict: Critical Risk, trust score 0/100.** phnxprotocol.live shows high-risk / scam indicators.

This assessment found strong scam indicators. Do not pay, sign in, or share personal details with this site.

Labels: Sensitive Interaction Risk, Governance Risk

Assessed 2026-10-20 by automated analysis. Classification confidence 75%.

| Field | Value |
| --- | --- |
| What this site appears to be | Phoenix Protocol is a Genesis NFT mint (888 pieces, 0.018 ETH) tied to the $EMBER token, with Burn, Revive, Vaporize and staking mechanics. The page presents profitable Burn rewards and a future NFT-flipping treasury, requires wallet connection and transaction signing, and provides no verifiable contract address, team identity, audit or contact channel. Financial-transaction interaction with missing proof places it in the CRITICAL band. |

## Evidence status and limitations


Evidence completeness: Not recorded

- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.

## At a glance

The checks that decide most of this verdict.

| Check | Result | Status |
| --- | --- | --- |
| Malware engines | None flagged it (VirusTotal) | Clear |
| Google Safe Browsing | Not listed (Google) | Clear |
| Abuse reports on the host | 0% confidence (AbuseIPDB, 0 reports; shared hosting inflates reports) | Clear |
| Domain age | 18 days old (Most scam domains are under a year old) | Risk |
| Web archive | Archived since 2026 (3 snapshots) | Clear |
| Certificate | Encrypted connection (Issued by YE1) | Noted |

## The page as captured


![Screenshot of the phnxprotocol.live homepage captured during the TrustSniffer assessment](https://trustsniffer.com/outputs/phnxprotocol.live/screenshots/first.png)

_What phnxprotocol.live served when TrustSniffer captured it on 2026-10-20. The page may look different now._

## Key findings


- Automated classification: Sensitive Interaction Risk.
- Domain age: less than 1 year (registration continuity).
- Public web-archive history exists since 2026.
- No flags from the reputation services TrustSniffer consulted at assessment time.

## Full analysis


### Security Alert

Fortinet flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a single-page NFT and token-launch landing site branded "Phoenix Protocol". It presents a closed "alpha group" Genesis NFT collection tied to a token called $EMBER. A visitor is asked to connect a crypto wallet, mint an NFT and take part in token-reward mechanics. The apparent business model is the sale of NFTs and tokens. As the page describes it, participant returns depend on new participants paying in rather than on a verifiable product.


### Scam/Impersonation Risk

No confirmed listing on a security or reputation source, brand impersonation, phishing finding or conflicting legal identities was observed. The site is nonetheless clearly cautionary, because its content and behavior carry strong fraud-pattern indicators. The homepage sells a collection of 888 Genesis NFTs at a fixed mint price of 0.018 ETH and says 40 pieces are reserved for the team at a "symbolic price". It describes Burn, Revive and Vaporize mechanics, staking tiers, and a future treasury that would fund NFT flipping and token buybacks. It says proceeds are routed to Uniswap liquidity, and that holders earn minted or burn-funded $EMBER rewards. Because the page says rewards are paid from new mints and new payments, the structure appears to resemble a Ponzi-style payout model. This is an assessment of the described mechanics, not a verified finding about how the contracts behave. The page also calls its mechanics "transparent" and "on-chain", says membership is "governed by smart contracts, not promises", and advertises "$EMBER CLAIMS ARE LIVE". It gives no contract address, audit or team identity to support any of these claims.

The wallet flow adds to the concern. It offers a very broad multi-chain selector covering Trust Wallet, TronLink, WalletConnect, Bybit, Binance Web3, OKX, Bitget, Ledger, imToken and TokenPocket, among others. It shows prompts such as "Reload the page and verify a different wallet" and a "Manual Claim" fallback, which resemble patterns seen on wallet-draining pages. Our own behavioral testing recorded many outbound requests to non-approved third-party destinations, including a large number of external POST submissions, plus repeated console errors. These observations come directly from that testing, but the data does not show what was sent or why, so they indicate risk and do not prove misuse. A security vendor is also reported to have flagged the domain, and a second source rated it suspicious. The specific detections and their underlying sources were not specified, so these are treated as soft third-party warnings or reputation notes and given reduced weight. They are not a confirmed listing. Taken together with the content and behavior above, they are consistent with the elevated assessment, but they are not what the assessment rests on.


Evidence:
- Homepage: 888-piece Genesis mint at 0.018 ETH, with 40 pieces reserved for the team, and rewards funded by Burn and Revive activity and by new mints.
- Homepage wallet flow: a multi-wallet selector with "verify a different wallet" and "Manual Claim" prompts, and the claim that mechanics are "governed by smart contracts", with no contract reference shown.
- Browser behavior testing: 12 external POST requests, 9 to non-approved destinations, across 3 test runs.
- Domain provenance: registered 2026-09-30 (about 19 days old). The web archive holds 3 snapshots, all from 2026 (first 2026-09-30, last 2026-10-09), so there is no established history.

### Regulatory Verification Notes

The site claims no license, regulator or registration number. It names no legal entity or operator, and the homepage publishes no team identity, audit report, physical address or contact channel. For a site that takes ETH payments and promises token rewards, these omissions are significant gaps in disclosure. They are not, on their own, proof of wrongdoing. Real-world operator identity remains unverified. Independent identity verification is low-scoring and low-confidence, and the on-page claims of transparency cannot be treated as evidence of it. No third-party broker or regulatory-database entry was matched. Nothing was found to offset the missing disclosures.


Evidence:
- Homepage: no license authority, license number, company name or jurisdiction is stated anywhere in the page content.
- Homepage: no contact channel, audit reference or named team members appear, despite financial-transaction calls to action.
- Registration: domain registered through NICENIC International Group Co., Limited, created 2026-09-30, expiring 2027-09-30.
- Transport encryption: TLS certificate issued by YE1 (DV, domain validation only), valid to 2026-12-29. This confirms encryption but does not confirm who operates the site.

### What to Verify Next

Before any payment or wallet interaction, the project's claims need independent confirmation outside the site. Any contract address should be located through an official channel that can be validated independently, then inspected on a public blockchain explorer for verified source code, ownership and admin privileges, token holder concentration and the team allocation. The claimed on-chain mechanics should be compared with what the contracts actually do. Any named team or auditor should be confirmed through an independent, offline route. Official communication channels should be confirmed through sources not linked from this page.


Evidence:
- Homepage: the mint and claim flows depend on wallet connection and transaction signing, so contract-level inspection should come first.
- Homepage: roadmap claims about a treasury, buybacks and NFT flipping have no supporting documentation to test against.
- Domain history: the site has only weeks of existence, so no track record or prior community history exists to rely on.

### Summary Verdict

The available evidence supports a clearly cautionary, elevated-risk assessment. Several fraud-pattern content signals converge on the same conclusion: a payment-first token and NFT model, unsupported claims, and unverified operator identity. A very recent domain and the soft third-party warnings, whose sources and details were not specified, add to that picture. The technical hygiene present does not offset it.


### Infrastructure Integrity

The site is served through Cloudflare's CDN and WAF. All observed addresses are edge servers, and the origin server was not observable. This provides basic transport and availability protection and is a mitigating factor only. It says nothing about who operates the project. It also means the underlying hosting cannot be independently verified, and it can mask rapid content changes.


### Closing Assessment

Prospective users should not connect a wallet, sign transactions or send funds until the project's contracts and operators have been independently verified. Viewing the page for information only is the proportionate limit of safe interaction in the meantime.


_Written analysis generated 2026-10-20 by the TrustSniffer Analysis Engine from the evidence in this report._

## What the analysis found

3 findings contributed to this verdict, raised by external reputation, page content, hosting and network.

### 01 External reputation
- Several malware engines flagged this domain. (External reputation `rule:EXT_BLACKLIST_HIGH`)

### 02 Page content
- The review of the page content rated it high risk. (Page content `rule:PAGE_RISK_HIGH`)
- The page shows few of the signs expected from a trustworthy operator. (Page content `rule:PAGE_TRUST_QUALITY_LOW`)
- The page content shows three or more warning signs that deceptive sites commonly use. (Page content `rule:PAGE_RED_FLAGS_STRONG`)

### 03 Hosting and network
- The domain was registered less than three months ago. (Hosting and network `rule:DNS_NEW_DOMAIN_90D`)

## Identity verification


| Field | Value |
| --- | --- |
| Status | UNVERIFIED |
| Identity score | 30/100 |
| Identity verification confidence | 50% |

- No on-site identity signals detected

_Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence._

## What TrustSniffer observed

First-party facts recorded during the assessment of phnxprotocol.live.

- The request stayed on phnxprotocol.live. It was not redirected to another domain. (Clear)
- Registration is published under NICENIC INTERNATIONAL GROUP CO., LIMITED. (Clear)
- DNS for this domain is served by cloudflare.com, across 2 name servers. (Noted)
- The registration is paid up to 2027-09-30. (Noted)
- The earliest public archive of this site is from 2026-09-30. (Clear)
- It is hosted on CLOUDFLARENET, from a server in US. (Noted)

## Domain intelligence


| Field | Value |
| --- | --- |
| Registrar | NICENIC INTERNATIONAL GROUP CO., LIMITED |
| Hosting | CLOUDFLARENET - Cloudflare, Inc., US |
| Country | US |
| Server IP | 2606:4700:3030::ac43:ada5 |
| Name servers | stevie.ns.cloudflare.com, bryce.ns.cloudflare.com |
| CDN / edge network | Detected (cloudflare) |
| Resolved IP addresses | 4 |
| Edge IP addresses | 4 |
| Likely origin IP addresses | 0 |
| SSL issuer | YE1 |
| SSL expiry | 2026-12-29 |
| Domain age | 0.05 years (continuous registration) |
| Domain expiry | 2027-09-30 |
| Archive first seen | 2026-09-30 |
| Archive snapshots | 3 |
| Reputation | VirusTotal: 0 flagged \| AbuseIPDB: 0% confidence, 0 reports \| Google Safe Browsing: 0 matches |

## About this assessment


**Was this report useful?** Tell other people what you think of TrustSniffer, good or bad. An honest review helps others decide whether to rely on these checks. [Review TrustSniffer on Trustpilot](https://www.trustpilot.com/review/trustsniffer.com)

A trust score summarises the evidence TrustSniffer could collect about phnxprotocol.live at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.

TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.

## Related on TrustSniffer
- [connect-portal.live](https://trustsniffer.com/report/connect-portal.live), another .live site assessed as critical-risk (Critical Risk, 3/100)
- [drop-opportunity.live](https://trustsniffer.com/report/drop-opportunity.live), another .live site assessed as critical-risk (Critical Risk, 0/100)
- [deepsnitch-ai.live](https://trustsniffer.com/report/deepsnitch-ai.live), another .live site assessed as critical-risk (Critical Risk, 5/100)
- [knoxexch.live](https://trustsniffer.com/report/knoxexch.live), another .live site assessed as critical-risk (Critical Risk, 0/100)
- [cedehub.live](https://trustsniffer.com/report/cedehub.live), another .live site assessed as critical-risk (Critical Risk, 0/100)
- [votes-alignedlayer.live](https://trustsniffer.com/report/votes-alignedlayer.live), another .live site assessed as critical-risk (Critical Risk, 0/100)
- [voting-alignedlayer.live](https://trustsniffer.com/report/voting-alignedlayer.live), another .live site assessed as critical-risk (Critical Risk, 0/100)
- [thesoudis.live](https://trustsniffer.com/report/thesoudis.live), another .live site assessed as critical-risk (Critical Risk, 10/100)
- [solspin-8dn.pages.dev](https://trustsniffer.com/report/solspin-8dn.pages.dev), another site assessed as critical-risk (Critical Risk, 0/100)
- [apesonsol.xyz](https://trustsniffer.com/report/apesonsol.xyz), another site assessed as critical-risk (Critical Risk, 0/100)
- [Every website and wallet TrustSniffer has assessed](https://trustsniffer.com/directory), the full risk directory
- [Other domains assessed as high-risk or phishing](https://trustsniffer.com/directory/phishing-domains), same verdict band
- [Check another website](https://trustsniffer.com/web-intelligence), run a new assessment
- [Check a crypto wallet address](https://trustsniffer.com/on-chain-risk), on-chain screening
- [The TrustSniffer Risk Index](https://trustsniffer.com/stats), how this verdict compares

## Guides
- [Stablecoin Freezes, Oct 27, 2026: 7 Wallets](https://trustsniffer.com/blog/stablecoin-freeze-report-2026-10-27)
- [No Age Distribution Yet for Suspicious Websites](https://trustsniffer.com/blog/no-age-distribution-suspicious-websites)
- [How to revoke token approval after a scam site](https://trustsniffer.com/blog/how-to-revoke-token-approval-after-a-scam-site)

---
*Source: [TrustSniffer](https://trustsniffer.com/report/phnxprotocol.live) — independent automated trust & fraud analysis. Cite as https://trustsniffer.com/report/phnxprotocol.live · assessed 2026-10-20.*