Is pistacio.io a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

Pistacio.io is a very recently registered website whose real content could not be seen by the automated visitor. Instead of a landing page, the visitor received a security interstitial headed "suspected phishing". The site's products, operator and business model are therefore unconfirmed, and what can be observed is a young domain carrying active external threat detections.

Scam/Impersonation Risk

The evidence shows hard contradictions that justify a clearly cautionary stance. External threat-intelligence sources currently flag the domain: several detection engines classify it as malicious or suspicious, including a tier-one security vendor, and a confirmed blacklist listing exists. The page served to the automated visitor was a suspected-phishing warning interstitial rather than site content, which points the same way. No conflicting legal-entity names were found, and no brand impersonation was established from page content. The risk therefore rests on reputation and threat listings, not on a demonstrated clone of a specific brand. Behavioral testing showed none of the harvesting techniques commonly seen in phishing kits: no wallet-drainer activity, no clipboard manipulation, no hidden forms and no credential forms posting to outside parties. It did show an unusually high share of outbound traffic, with dozens of calls to external services and several outbound POST submissions. That is consistent with heavy third-party dependency, but it cannot be reconciled with the threat listings from the evidence available. No contact artifacts or product claims were retrievable, so no on-site promise (yield, leverage, or similar) can be assessed. Evidence:

• Homepage: the captured page returned a blocking status with a "suspected phishing" interstitial title, and only a short text body was captured.
• Reputation: two detection engines rated the domain malicious and three suspicious, including one tier-one vendor, and an external blacklist flag is active.
• Behavior (three successful sandbox runs): 93 external XHR/fetch calls, 9 external POSTs, about 97% maximum external traffic share, 20 console errors, and 1,523 DOM mutations after interaction. No wallet-drainer, clipboard-hijack or hidden-form activity was detected.
• Domain provenance: registered 2026-08-30 (~0.15 years old), so the domain has no established track record.

Regulatory Verification Notes

No licensing, registration or legal-entity information could be assessed. The legal and identity pages were not reachable behind the interstitial, so the disclosure position remains unclear and no regulated status is evidenced. No third-party broker profile matched the domain, so there is no reputational context to weigh either way. The registration record is held through a privacy service at a mainstream registrar. This is an administrative detail and is not treated as an identity finding. The transport encryption is valid but is only domain-validated, so it confirms an encrypted channel and says nothing about who operates the site. Identity remains independently unverified. Evidence:

• Registration: Dynadot Inc registrar, privacy-service registrant, created 2026-08-30 and expiring 2027-08-30 (~0.15 years old).
• Transport security: TLS certificate issued by WE1 (DV), valid to 2026-11-28 (33 days remaining).
• Hosting: served from AS13335 (Cloudflare, Inc., US).
• Disclosure: no legal or licensing content was captured from the homepage.

What to Verify Next

Any claim of licensing or authorization the operator makes should be checked directly against the relevant regulator's public register, not against the site. The operator's identity should be established through independent, offline channels before any relationship begins. If the site is believed to be a compromised legitimate service, the claimed organization should be contacted through its already-known official channels and asked whether it operates this domain. The domain should be re-evaluated after the threat listings are reviewed or cleared. Evidence:

• Homepage: no operator name or regulator reference was captured.
• Reputation: the active blacklist flag and detection verdicts should be rechecked after remediation or delisting.
• Registration: the domain is only weeks old, so no prior ownership history exists to lean on.

Summary Verdict

The overall posture is high-risk. Active third-party detections and a confirmed blacklist listing outweigh the technical hygiene signals, such as a valid certificate and a recognizable hosting provider. The domain's youth and unconfirmed identity leave nothing to offset those detections.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and WAF, and all four observed addresses are Cloudflare edge servers, so the origin server is not visible. This offers some mitigation, because a well-known provider fronts the site, a valid certificate is in place and bot protection is active. It does not establish legitimacy, and edge-only visibility prevents independent confirmation of where the content is actually hosted. It also allows content to be swapped quickly without any visible infrastructure change. An unconfirmed heuristic notes a young domain with few subdomains, which fits the registration timeline and carries no independent weight.

Closing Assessment

The site should be treated as read-only at most. Logging in, entering credentials, connecting wallets, or making any payment or financial transfer should be avoided until the threat listings are independently resolved and the operator's identity is confirmed.