Is pistacio.meme a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

Pistacio is a single-page website on the meme-themed ".meme" top-level domain. Its homepage carries the title "PISTACIO — His nickname on the street is Pistacio." and a short block of narrative text. The page reads like a branded, character-driven landing page for a meme-style project. It shows no clear product, service or company description, so the commercial purpose and business model are not established from the captured content.

Scam/Impersonation Risk

This site is blacklisted by external threat-intelligence sources, and that is the decisive finding. Several independent security engines classify the domain as malicious, and one of them flagged it as suspicious. The detections are broad, but the available data does not say what behaviour they target. Nothing shows a conflicting corporate identity or a copied brand, so this is a reputation-driven contradiction rather than an impersonation finding. The domain is also very recently registered. Its web-archive footprint is a single capture, which gives no history of stable, legitimate operation. Sandbox sessions of the homepage were technically uneventful. They showed no outbound data submissions, no wallet-connection prompts, no hidden forms, and no cloaking. However, a clipboard write was observed on the page, and a large share of the page's loaded resources came from third-party origins. Neither is conclusive on its own, but both fit poorly with a clean verdict. These behavioural positives do not offset the blacklisting, because a page can look benign in a sandbox while still being flagged for abuse. Evidence:

• Homepage: multiple security engines currently rate the domain malicious, and one rates it suspicious. A confirmed blacklist hit is recorded.
• Domain registration: registered on 2026-08-26 (~0.16 years old) through Dynadot LLC., with expiry on 2027-08-26.
• Web archive: 1 snapshot, captured in 2026 (1 year tracked), so there is no meaningful independent history.
• Homepage behaviour: a clipboard write was detected, with no hijack attempts across 3 sandbox runs. Roughly 71% of loaded resources were external, although no external data requests were made.

Regulatory Verification Notes

The captured homepage identifies no operating company, jurisdiction, license, registration number or accountable individual. Real-world operator identity is therefore unverified, and the domain's registration details are incomplete, which adds to the ownership opacity. These are disclosure gaps and not proof of wrongdoing. They carry more weight here because they sit alongside a confirmed blacklisting. No broker-reputation or regulatory-registry match was found for the name, so there is no third-party licensing context either way. The page offers no legal pages, terms, or risk disclosures that would let a visitor judge who stands behind the site. Evidence:

• Homepage: no company name, licensing statement, registration number or legal-entity disclosure appears in the captured content.
• Registration record: ownership details are incomplete; the registrar is Dynadot LLC.
• Transport security: the TLS certificate is DV-level, issued by WE1, valid to 2027-01-22. This confirms encrypted transport but does not verify who operates the site.

What to Verify Next

Contact and operator details should be established through independent routes, not through anything on the site. Any claim the project makes about its team, token, product or backers should be confirmed through official channels the user finds independently of this domain. Anyone considering an interaction should check the current status of the external detections, since the flagged content may change. If the project claims a regulated activity, the claimed operator should be matched against the relevant official registry. Official support or contact channels should be confirmed by an offline or otherwise independent route. Evidence:

• Homepage: no verifiable operator, licensing or contact credentials are presented for cross-checking.
• Domain record: the domain is under three months old, so any claimed track record cannot predate this registration.
• Web archive: the single capture offers no earlier version of the site to compare against.

Summary Verdict

The evidence points to an elevated-risk, cautionary posture. A confirmed blacklisting by external threat-intelligence sources, a very new domain with no established history, and an unverified operator outweigh the technically clean sandbox behaviour. Real-world identity is unknown, and no evidence in this analysis supports a presumption of legitimacy.

Infrastructure Integrity

The site is served through Cloudflare (AS13335, United States), a mainstream CDN and WAF provider. All four observed addresses are edge servers, and the origin host was not observable. This protection mitigates exposure to common network attacks, but it does not speak to the operator's intent. It also does not offset the external reputation findings. Evidence:

• Hosting: served from AS13335 (CLOUDFLARENET - Cloudflare, Inc., US), registry ARIN.
• Edge addresses: 4 edge IPs observed (2 IPv4, 2 IPv6), 0 origin candidates.

Closing Assessment

Read-only viewing is the only use consistent with the available evidence. Account login, credential entry, wallet connection and any payment or financial transaction should be avoided until the external detections are cleared and the operator is independently verified.