Verdict
This assessment found strong scam indicators. Do not pay, sign in, or share personal details with this site.
ploplo.live shows high-risk / scam indicators.
Evidence status and limitations
Evidence completeness: Not recorded
- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.
At a glance
The checks that decide most of this verdict.
| Malware engines | 8 flagged itVirusTotal | Risk |
|---|---|---|
| Google Safe Browsing | Not listedGoogle | Clear |
| Abuse reports on the host | 0% confidenceAbuseIPDB, 0 reports; shared hosting inflates reports | Clear |
| Domain age | 1 months oldMost scam domains are under a year old | Risk |
| Web archive | Archived since 20263 snapshots | Clear |
| Certificate | Encrypted connectionIssued by YE2 | Noted |
The page as captured
Key findings
- Automated classification: Sensitive Interaction Risk.
- Domain age: less than 1 year (registration continuity).
- Public web-archive history exists since 2026.
- At least one reputation service TrustSniffer consulted had flagged this domain at assessment time.
Full analysis
Security Alert
Fortinet, Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.
ploplo.live is a very recently registered website whose landing page, when analysed, presented a browser-protection interstitial headed "Suspected Phishing" instead of its own content. The page offered no visible products, branding or business description, so its commercial purpose cannot be established from the pages captured. What a visitor meets is a security warning, not a service.
Scam/Impersonation Risk
The evidence supports a clearly cautionary assessment. Multiple independent threat-intelligence sources currently flag the domain as malicious, and this is a confirmed blacklist condition. It is the decisive factor in the assessment. No brand impersonation and no conflicting legal identities were observed, so the risk does not come from identity contradictions. It comes from the site's standing in external reputation sources. The blacklist, combined with a domain only weeks old and almost no archive history, is the profile of disposable infrastructure often used for phishing or credential-harvesting campaigns. Behavioural testing adds context. Nearly all network requests during page load went to external destinations, with a heavy volume of background requests and a large burst of page-structure changes after interaction. The browser also logged repeated script errors. Those requests all went to recognised, whitelisted destinations. Testing found no wallet-connection prompts, clipboard manipulation, hidden forms or credential posts to third-party hosts. These absences do not offset the blacklist.
- Homepage: the page returned an access-denied status behind a security challenge, and its title identified it as a suspected-phishing warning.
- External reputation: several security vendors, including two top-tier ones, flagged the domain as malicious, and one further vendor flagged it as suspicious.
- Domain provenance: registered in September 2026 (~0.11 years, ~40 days old) through NICENIC International Group Co., Limited, with registration running to September 2027.
- Archive depth: 3 archive snapshots spanning 11–19 September 2026 (1 year tracked), all within days of registration, so there is no established history.
Regulatory Verification Notes
No licence, company registration or legal-entity disclosure could be assessed, because the captured page showed only a security interstitial and no legal, terms or about pages. The disclosure position is therefore unclear, and this is not treated as evidence of wrongdoing. Registrant details are incomplete, which is ownership opacity and not an identity contradiction. The site's technical hygiene is sound: its transport encryption is valid and it sits on mainstream hosting. A valid certificate only proves an encrypted connection, not the operator's legitimacy. No third-party broker or regulator-database entry matched the domain, so there is no external regulatory context either way.
- Legal and identity pages: none was captured, and no company name, licence or registration number was presented.
- Hosting: served from AS13335 (Cloudflare, Inc., US).
- Transport encryption: TLS certificate issued by YE2 (domain-validated, DV), valid to 2026-12-10.
- Broker databases: no match found, so no licensing claim exists to assess.
What to Verify Next
Any prospective interaction should first depend on the site's external reputation being cleared. The operator should be asked to show it has been re-reviewed and delisted by the flagging sources. Any claimed business identity should be checked against an official company or financial-regulator registry, not against the site's own statements. Official contact channels should be confirmed through an independent route, such as a verified listing on a known platform or a direct call to a published number. Checks should be repeated after several months, since a clean history cannot be built on a domain this young.
- Reputation: threat-intelligence listings are active now and need to be re-checked for delisting.
- Identity: no operator name was presented for registry matching.
- Domain age: the domain is far too recent to support reliance on its track record.
Summary Verdict
The site carries an elevated risk posture. The decisive reason is that external threat-intelligence sources currently flag it as malicious. That outweighs the technical hygiene signals, and the domain's newness and minimal history add to the concern. Nothing observed establishes the operator's real-world identity or legitimate purpose.
Infrastructure Integrity
The site is fronted by a major CDN and web application firewall, and every observed address belongs to edge servers, so the origin host was not observable. This protection and the bot-challenge screening are mitigating factors only. They show the operator has put a mainstream security layer in front of the site. They do not show legitimacy, and the same edge-only visibility prevents independent confirmation of where the content is hosted.
Closing Assessment
The site should not be used for login, credential entry, payments or any financial interaction, and nothing should be downloaded from it. Passive viewing alone is tolerable, and only in an isolated, up-to-date browser. Anyone who has already entered credentials or payment details should change those credentials and monitor the relevant accounts.
Written analysis generated 2026-10-22 by the TrustSniffer Analysis Engine from the evidence in this report.
What the analysis found
5 findings contributed to this verdict, raised by external reputation, hosting and network, history in the web archive, behaviour in a sandbox, registration and ownership.
01 External reputation
- An external threat feed lists this domain: either Google Safe Browsing marked it malicious, or a significant number of malware engines flagged it.External reputation
rule:EXT_BLACKLIST_CRITICAL
02 Hosting and network
- The domain was registered less than three months ago.Hosting and network
rule:DNS_NEW_DOMAIN_90D
03 History in the web archive
- The web archive has almost no record of this domain, which fits a site that is new.History in the web archive
rule:ARCH_PEN_YOUNG_AND_SPARSE
04 Behaviour in a sandbox
- Most of what the page loaded came from other domains rather than from this one.Behaviour in a sandbox
rule:BEHAV_EXTERNAL_RATIO_HIGH - The structure of the page changed sharply while it was loading.Behaviour in a sandbox
rule:BEHAV_DOM_DENSITY_SPIKE
05 Registration and ownership
- The public registration record for this domain is incomplete.Registration and ownership
rule:KF_WHOIS_INCOMPLETE
Identity verification
| Status | UNKNOWN |
|---|---|
| Identity score | 50/100 |
| Identity verification confidence | 30% |
- AI page analysis unavailable (page captured; identity not AI-verified)
Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence.
What TrustSniffer observed
First-party facts recorded during the assessment of ploplo.live.
- The request stayed on ploplo.live. It was not redirected to another domain. Clear
- Registration is published under NICENIC INTERNATIONAL GROUP CO., LIMITED. Clear
- DNS for this domain is served by cloudflare.com, across 2 name servers. Noted
- The registration is paid up to 2027-09-11. Noted
- The earliest public archive of this site is from 2026-09-11. Clear
- It is hosted on CLOUDFLARENET, from a server in US. Noted
Domain intelligence
| Registrar | NICENIC INTERNATIONAL GROUP CO., LIMITED |
|---|---|
| Hosting | CLOUDFLARENET - Cloudflare, Inc., US |
| Country | US |
| Server IP | 2606:4700:3034::6815:4faa |
| Name servers | bonnie.ns.cloudflare.com, junade.ns.cloudflare.com |
| CDN / edge network | Detected (cloudflare) |
| Resolved IP addresses | 4 |
| Edge IP addresses | 4 |
| Likely origin IP addresses | 0 |
| SSL issuer | YE2 |
| SSL expiry | 2026-12-10 |
| Domain age | 0.11 years (continuous registration) |
| Domain expiry | 2027-09-11 |
| Archive first seen | 2026-09-11 |
| Archive snapshots | 3 |
| Reputation | VirusTotal: 8 flagged | AbuseIPDB: 0% confidence, 0 reports | Google Safe Browsing: 0 matches |
About this assessment
A trust score summarises the evidence TrustSniffer could collect about ploplo.live at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.
TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.