Is rhinofi-dex.net a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website, served from the domain rhinofi-dex.net, presents itself on its homepage as "Rhino App", billed as a "#1 multi-chain bridge & swap" that promises to exchange USDT, USDC and ETH "instantly". It is a crypto-asset bridging and swapping front end, and its apparent business model is facilitating token transfers and conversions between blockchains. The domain name pairs a brand-like term with "dex", which positions the site as a decentralized-exchange interface.

Scam/Impersonation Risk

Contradictory signals are present and are the decisive element of this assessment. Several major security vendors independently classify the domain as malicious, and it sits on a confirmed external blacklist. This is a hard, convergent reputational signal rather than an isolated flag. Separately, the hosting address has attracted abuse reports, but those are attributed to shared provider infrastructure and are weaker evidence about this site specifically. The domain is also only a few months old and has almost no independent history, so there is no track record to counterbalance the detections. The homepage title leads with the unverifiable superlative "#1" and promises instant stablecoin and ETH exchange. These are classic claims for sites that try to attract deposits or wallet interaction. No conflicting legal identities were observed, and automated browsing sessions showed no external data calls, no wallet-connection prompts and no clipboard manipulation. That behaviour is a limited mitigating observation and does not offset the blacklist. The domain should be treated as a probable fraud or phishing vector for any wallet or credential interaction. Evidence:

• Homepage and domain reputation: multiple independent security engines, including three prominent endpoint-security vendors, flag the domain as malicious, and it appears on an external blacklist.
• Domain provenance: registered 2026-07-30 (~0.25 years, about three months old); the web archive holds 1 snapshot, first and last seen 2026-07-31, covering a single year.
• Hosting address: 5 abuse reports against the shared hosting IP, the most recent about a week before analysis.
• Behavioral sandbox: 3 of 3 sessions completed with a stable page load, zero external requests and no wallet-drainer or clipboard behaviour.

Regulatory Verification Notes

No regulator, licensing registry or third-party broker database confirms a licensed operator behind this domain. No broker-reputation match was found, and that absence is context only, not a legal or licensing verdict. The operator's real-world identity is unverified: the evidence connects the domain neither to a named company nor to the genuine Rhino brand that its naming evokes. A service that moves and converts customer funds across chains would ordinarily be expected to be traceable to an accountable entity, and none is established here. The domain's registration record is complete, which is routine and does not amount to legitimacy. The valid but entry-level certificate shows only that encryption is in place, not who runs the site. Evidence:

• Registration: domain registered through the registrar Atak Domain, with the current term running to 2027-07-30.
• Transport security: TLS certificate issued by YR2 at DV (domain-validated only) level, valid to 2027-01-19, so it proves control of the domain but not an organization.
• Hosting: served from AS59692 (IQWEB, IQWeb FZ-LLC, United Arab Emirates).
• Broker reputation: no matching broker profile in the third-party reputation dataset.

What to Verify Next

Before any interaction, confirm the official Rhino website and social channels through independently sourced references, such as the project's verified accounts or documentation reached by manual search, never through links on this site. Establish whether any regulator's public register lists an operator for this service. If any wallet approval or transaction has already been made through this domain, review and revoke the associated token approvals and check the wallet for unexpected transfers. Re-check the domain's security reputation later, since listings can change as the site is investigated or cleaned. Evidence:

• Identity: the operator has not been independently linked to a real-world brand, company or person.
• Naming: the domain's brand-like name combined with "dex" is not matched by any confirmed affiliation with the genuine project.
• Reputation trend: abuse reports against the hosting address were still being filed within the past week, so the picture is current.

Summary Verdict

The overall posture is high-risk and clearly cautionary. Independent threat detections and a confirmed blacklist outweigh every neutral or mildly positive technical signal. The site's apparent legitimacy rests only on surface features that a newly created domain can easily acquire. Its identity remains unverified, so the evidence does not support treating it as a genuine bridge or exchange service.

Infrastructure Integrity

The site resolves to a single address at a UAE-based hosting provider, IQWeb FZ-LLC. No CDN or WAF fronts it, so there is no protective layer to mitigate exposure. A heuristic flag notes a mismatch between the address's registry and geography. It is unconfirmed and carries little weight alongside the reputational findings. The TLS certificate is currently valid, but it does not change the assessment.

Closing Assessment

The site should not be used for login, credential entry, wallet connection or any financial transaction. At most, the homepage may be viewed passively, and any file or software offered there should not be downloaded. Anyone who has already interacted with it should treat those wallets and accounts as potentially exposed and act accordingly.

Signals weighed against the site

• AbuseIPDB: 5 reports on hosting IP 186.2.175.35 (IQWeb FZ-LLC, Data Center/Web Hosting/Transit), 10% confidence. The reports are attributed to shared infrastructure, not specifically to this website.