Is proposal-flybrain.site a scam? TrustSniffer's high-risk assessment: 13/100

Security Alert

Fortinet flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

The domain presents a single-page front end whose captured title reads "FindYourBroker.io", which suggests a broker-discovery or brokerage-comparison service. That title does not match the site's own hostname, which refers to a "proposal" and "flybrain". The homepage carried about two and a half thousand characters of text. It was captured successfully and answered normally, but no reliable product, company or business-model description could be recovered from it. Its apparent purpose is therefore to steer visitors toward financial brokers, and the operator behind it is unidentified.

Scam/Impersonation Risk

Contradictory signals are present, and they are decisive. The domain is blacklisted by external threat-intelligence sources. Several independent security engines classify it as malicious or suspicious, including a tier-one vendor. The site is also treated as a known phishing candidate. No conflicting legal entities were found, and no brand impersonation or phishing content was confirmed on the page itself. The risk therefore rests on the external listings and on the site's very recent creation, which fits throwaway infrastructure. Behavioural testing adds corroborating context. Almost all network activity during the visit went to third-party destinations, and the great majority of it was not on any known-benign list. One of the few outbound POST requests went to a non-whitelisted external destination, which is a possible data-exfiltration path. The page also rebuilt itself heavily after interaction, so the content a visitor first sees may not be what the site ends up serving. The same testing found no wallet-drainer behaviour, clipboard tampering, hidden forms, cloaking or external password forms. The risk is the unexplained third-party traffic combined with the external listings, not a demonstrated exploit. No contact address was published on the captured page. Evidence:

• Homepage: external reputation sources currently flag the domain as malicious or suspicious, and a tier-one vendor is among them.
• Homepage behaviour: 2,826 external XHR/fetch requests across 3 runs, 98.9% of activity external, and 1 non-whitelisted external POST.
• Homepage behaviour: 1,526 DOM mutations after interaction, with no cloaking, hidden-form or wallet-drainer behaviour detected.
• Domain provenance: registered 2026-09-15 (~0.1 years old), with 3 archive snapshots from 2026-09-15 to 2026-09-25 (1 year tracked).

Regulatory Verification Notes

The captured page gave no clear legal-entity, licensing or registration disclosure. This is a transparency gap, not proof of wrongdoing, but here it compounds the external listings. A site that points visitors toward financial brokers would ordinarily show who operates it and under which authority. Ownership and governance are opaque, and the real-world operator could not be connected to any person or company. The domain is held through a commercial registrar, NiceNIC International Group Co., Limited. No third-party broker-reputation dataset matched the site, so no external reputational or regulatory context is available for it. The site's certificate and hosting identity are routine and do not establish who runs it. Evidence:

• Homepage: no company name, licence number or regulator reference was identified in the captured text.
• Domain registration: registered through NiceNIC International Group Co., Limited, created 2026-09-15 and expiring 2027-09-15.
• Transport security: TLS certificate issued by YE1 (DV, domain validation only), valid to 2026-12-13.
• Hosting: served from AS13335 (Cloudflare, Inc., US).

What to Verify Next

Before any interaction, the operator's claims should be tested independently. The site's own statements should not be relied on. If it names a broker or advisory firm, that firm's authorisation should be looked up directly in the relevant national financial-regulator register. Any contact or support channel should be confirmed through an independent route, such as a number or address published by the regulator or the firm's own established website. The domain's relationship to any legitimate broker-comparison brand should be checked by reaching that brand's official site, not by following links from this one. Re-checking the external reputation listings after some weeks would show whether they have been cleared or have grown. Evidence:

• Homepage: the page title names a broker-search brand that differs from the hostname, and no operator is stated.
• Domain age: the very recent creation date leaves no long operating history to rely on.
• Reputation: external listings are active at the time of analysis.

Summary Verdict

The site presents an elevated, clearly cautionary risk posture. Externally confirmed adverse listings, a newly created domain with minimal history and an unidentified operator converge on the same conclusion. Neither a valid certificate nor an otherwise orderly page load offsets them. Legitimacy cannot be established on the available evidence, and the site is suitable for passive viewing at most.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and WAF, and every observed address is a Cloudflare edge server. The origin server was not observable, so the real hosting location cannot be independently verified and content could be changed behind the edge without notice. This protection is a mitigating factor only. It reduces direct exposure of the origin, but it does not vouch for the operator, and it cannot offset the reputation findings. A sparse subdomain footprint on a newly registered domain was flagged only as an unconfirmed heuristic and carries little weight on its own.

Closing Assessment

Treat this site as read-only at most. Do not enter credentials, log in, connect any account or wallet, or submit personal or financial information. Do not download files from it. Anyone who has already interacted with it should change any reused passwords and monitor the accounts concerned. Engage with brokers only through channels confirmed independently.