Is photontrade.lol a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

Photon, presented as "Your Trusted Platform for Token Discovery & Trading", is a single-page crypto trading terminal that invites visitors to "snipe and sell" newly listed tokens. It centres on a "Connect Phantom" wallet prompt and promotes "fastest audit results", lightning-speed transactions and a "Photon points" rewards programme. It supports six blockchains: Solana, Ethereum, BNB Chain, Tron, Base and Blast. It is offered in English and Chinese, and its apparent business model is to earn trading fees or spread on swaps executed from the user's own wallet. The page does not disclose the fee structure, custody model or revenue sources.

Scam/Impersonation Risk

The site carries a confirmed blacklist listing. Multiple independent threat-intelligence engines, including a tier-one antivirus vendor, currently flag the domain as malicious or suspicious. This is the decisive contradiction and it is not offset by anything else in the evidence. No brand impersonation, phishing page or conflicting legal identity was observed, and the page names only one corporate entity. The listing, together with the page's content, still places this in a clearly high-risk category. The homepage uses the superlative "Your Trusted Platform" and claims the "fastest audit results" with no audit report, auditor or methodology behind it. Its "Gains with Photon" ticker shows anonymised wallet fragments selling $WYNN for +2,837%, $HOPPY for +1,578% and $BONG for +1,240%. These are unverifiable and typical of social-proof lures that make speculative meme-token trading look reliably profitable. The page carries no risk warning, even though the first interaction it asks for is connecting a wallet to trade volatile, newly launched tokens. Behavioural testing of the page did not observe wallet-draining routines, hidden forms, cloaking or undisclosed outbound data transfers. That finding is limited to the tested page and does not cancel the reputation listing or the unsupported claims. Evidence:

• Homepage: headline claims "fastest audit results" and "Your Trusted Platform", with no audit report or auditor named.
• Homepage: the profit showcase lists three meme tokens with gains of +2,837%, +1,578% and +1,240% attributed to truncated wallet addresses that cannot be traced.
• Domain registration: the domain was created on 2026-09-27, about 22 days (~0.06 years) before this assessment, through Namecheap.
• Several threat-intelligence engines currently flag the domain, which is the basis for the blacklist finding.

Regulatory Verification Notes

The only identity artefact is a footer notice, "© Tiny Astro Inc. 2025", beside links to Terms of Use and Privacy Policy. The page gives no jurisdiction, registration number, registered address or regulator, and no licence for operating a token-trading or brokerage-style service. The 2025 copyright year also predates the domain's September 2026 registration. That timing means the claimed corporate lineage cannot be tied to this domain from anything on the site. These are verification gaps rather than proof of wrongdoing, but with a service that handles user funds and a blacklist listing, nothing on the site mitigates them. No third-party broker or regulatory-database match was found for the site, and that absence is neutral, not a verdict. The transport-layer evidence confirms only that encryption is in place. It says nothing about who operates the service. Evidence:

• Homepage footer: names Tiny Astro Inc. with a 2025 copyright and no registration number, jurisdiction or licence.
• Homepage: no fee schedule, custody statement or risk disclosure accompanies the trading and points claims.
• Hosting: served from AS13335 (Cloudflare, Inc., US).
• Transport encryption: TLS certificate issued by YE1 (domain-validated, DV), valid to 2026-12-26.

What to Verify Next

Any contact with the service should start with confirming that the claimed operator exists. Search the corporate registry in the relevant jurisdiction for Tiny Astro Inc. and check whether it has any link to this domain. Next, establish whether any regulator lists a licence or registration for a token-trading service of this kind. The official Photon channels and web address should be confirmed through an independent route, such as the project's established public documentation or a trusted community source, and not through links on this domain. Anyone who has already connected a wallet to this site should review and revoke the token approvals granted to it and check recent transactions. Evidence:

• Homepage footer: the sole named entity, Tiny Astro Inc., is the starting point for registry checks.
• Homepage: the "Documentation" link and the wallet prompt are the places where on-site claims about the service are made.
• Homepage: the "Connect Phantom" and "Connect wallet" prompts are the point at which approvals could be granted.

Summary Verdict

The overall posture is high risk, and the assessment is clearly cautionary. A confirmed external blacklist listing, a domain only weeks old, and sensational, unevidenced trading claims on a page that asks for wallet access converge on the same conclusion. The polished interface and the clean behavioural run are insufficient to offset this.

Infrastructure Integrity

The site is delivered through Cloudflare's CDN and web application firewall, and all observed addresses are CDN edge servers, so the origin server is not visible. A valid, mainstream-issued TLS certificate is also in place. These are mitigating factors only. They show competent hosting hygiene but neither establish the operator's legitimacy nor offset the reputation listing, and edge-only visibility makes independent hosting verification and detection of rapid content changes harder.

Closing Assessment

Interaction should be limited to passive viewing at most. Wallet connection, credential entry, token approvals and any deposit or trade should be withheld, and the domain should not be treated as an official Photon channel. Anyone who has already interacted with it should act immediately to secure their assets and report the domain to their security team or relevant abuse channels.