Verdict
This assessment found strong scam indicators. Do not pay, sign in, or share personal details with this site.
rtxtoken.info shows high-risk / scam indicators.
Evidence status and limitations
Evidence completeness: Not recorded
- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.
At a glance
The checks that decide most of this verdict.
| Malware engines | 12 flagged itVirusTotal | Risk |
|---|---|---|
| Google Safe Browsing | Not listedGoogle | Clear |
| Abuse reports on the host | 0% confidenceAbuseIPDB, 0 reports; shared hosting inflates reports | Clear |
| Domain age | 2 months oldMost scam domains are under a year old | Risk |
| Certificate | Encrypted connectionIssued by WE1 | Noted |
| Hosted by | CLOUDFLARENETServer in US | Noted |
The page as captured
Key findings
- Automated classification: Sensitive Interaction Risk.
- Domain age: less than 1 year (registration continuity).
- At least one reputation service TrustSniffer consulted had flagged this domain at assessment time.
Full analysis
Security Alert
Fortinet, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.
The domain rtxtoken.info is a recently registered, token-branded website on the .info top-level domain. Its name suggests a cryptocurrency or digital-asset offering, but the site shows a visitor no product pages or business description. The only content served during review was a short security interstitial from its content delivery network, titled as a suspected-phishing warning. Its apparent purpose is a token or crypto-asset promotion front. The evidence does not show what it offers.
Scam/Impersonation Risk
Contradictory signals are present and decisive. The domain is currently blacklisted. A multi-engine reputation scan returned a substantial number of malicious verdicts, including from several top-tier security vendors, and an external blacklist feed also lists it. Prior phishing association is recorded for the domain. The page that loads on the homepage is the CDN provider's own "suspected phishing" interstitial, which is an independent warning against the site. No conflicting legal-entity names were observed, and no specific brand impersonation was confirmed. The risk is driven by the blacklisting and phishing association. Behavioural testing found no wallet-connection prompts, no clipboard manipulation, and no hidden or credential-harvesting forms in the sessions that completed. That does not offset the reputation findings. The site also made a heavy share of its network activity to external destinations, including repeated outbound data posts, and generated a high volume of script errors. That pattern fits a thin or unstable page that relies heavily on third-party calls. A site this new, flagged by multiple security engines, and framed as a token project matches the profile of short-lived fraud and phishing infrastructure.
- Homepage: the captured page title reads as a suspected-phishing warning from the CDN provider, and the page returned an access-denied response to the automated visit.
- Reputation: 12 security engines flagged the domain as malicious and 3 as suspicious, including two top-tier vendors, and an external blacklist also lists it.
- Domain provenance: registered 2026-08-14 (~0.2 years, ~74 days old), so the domain has almost no operating history.
- Browser behaviour: 29 external XHR requests, 9 external POST requests, 26 console errors, and a very high share of external traffic; no wallet-connect, clipboard-write, or hidden-form activity was detected.
Regulatory Verification Notes
No licensing, registration, or legal-entity information could be observed on the content reached, so there is no on-page basis for treating the operator as a regulated or accountable business. The registration record is incomplete as to the owner, which is ownership opacity and not an identity contradiction. No third-party broker or regulatory-database match exists for the site, so there is no external reputational context to weigh either way. Identity is unverified, and nothing supports linking the site to a real-world brand or person. The contradiction in this case comes from the blacklisting, not from any licensing or disclosure gap.
- Domain registrar: Dynadot Inc; registration runs 2026-08-14 to 2027-08-14, a single one-year term.
- Transport security: TLS certificate issued by WE1 (DV, domain validation only), valid to 2027-01-10. A DV certificate confirms control of the domain and says nothing about who operates it.
- Homepage: no company name, licence, or registration number was visible in the content reached.
What to Verify Next
Do not seek assurance from the site itself. Any claimed company name, licence, or token issuer should be checked through the relevant financial-regulator registry and an independent corporate registry. Any contract address or token listing the site cites should be confirmed on the issuing project's official channels, reached by an independent route. Official support and contact channels should likewise be confirmed independently. Anyone who has already interacted with the site should review wallet approvals and revoke any granted permissions, and should change any credentials that were entered.
- Homepage: no product, issuer, or contact detail could be confirmed, so independent confirmation is the only route to verifying any claim.
- Reputation findings: the blacklisting means any prior interaction should be treated as potentially exposed.
- Domain history: the domain's short life gives no track record against which to benchmark claims.
Summary Verdict
The overall posture is high risk. Independent threat detections and a blacklist listing, combined with a very young domain and an unidentified operator, outweigh the technical hygiene the site shows. The evidence points to a site that should be treated as hostile until proven otherwise, and nothing supports a reassuring reading.
Infrastructure Integrity
The site sits behind Cloudflare, a mainstream CDN and WAF, and all observed addresses are CDN edge servers. The origin server was not observable, so the real hosting location cannot be independently assessed. The valid TLS certificate and the protective edge are mitigating signals only. They do not establish legitimacy and cannot offset the reputation findings.
- Hosting: served from AS13335 (CLOUDFLARENET - Cloudflare, Inc., US) via four edge addresses; no origin address was observed.
- Bot protection: Cloudflare's challenge was active during the visit.
Closing Assessment
Avoid entering credentials, connecting a wallet, approving transactions, or sending funds. Do not download anything from the site. Treat any link, message, or advertisement directing users to it with suspicion, and report it to the relevant platform or security team.
Written analysis generated 2026-10-27 by the TrustSniffer Analysis Engine from the evidence in this report.
What the analysis found
4 findings contributed to this verdict, raised by external reputation, hosting and network, behaviour in a sandbox, registration and ownership.
01 External reputation
- An external threat feed lists this domain: either Google Safe Browsing marked it malicious, or a significant number of malware engines flagged it.External reputation
rule:EXT_BLACKLIST_CRITICAL
02 Hosting and network
- The domain was registered less than three months ago.Hosting and network
rule:DNS_NEW_DOMAIN_90D
03 Behaviour in a sandbox
- Most of what the page loaded came from other domains rather than from this one.Behaviour in a sandbox
rule:BEHAV_EXTERNAL_RATIO_HIGH - The page produced an unusually high number of errors while it ran.Behaviour in a sandbox
rule:BEHAV_CONSOLE_ERRORS_HIGH - The page made many background requests to other domains while it was open.Behaviour in a sandbox
rule:BEHAV_EXTERNAL_XHR_HEAVY
04 Registration and ownership
- The public registration record for this domain is incomplete.Registration and ownership
rule:KF_WHOIS_INCOMPLETE
Identity verification
| Status | UNKNOWN |
|---|---|
| Identity score | 50/100 |
| Identity verification confidence | 30% |
- AI page analysis unavailable (page captured; identity not AI-verified)
Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence.
What TrustSniffer observed
First-party facts recorded during the assessment of rtxtoken.info.
- The request stayed on rtxtoken.info. It was not redirected to another domain. Clear
- Registration is published under Dynadot Inc. Clear
- DNS for this domain is served by cloudflare.com, across 2 name servers. Noted
- The registration is paid up to 2027-08-14. Noted
- It is hosted on CLOUDFLARENET, from a server in US. Noted
Domain intelligence
| Registrar | Dynadot Inc |
|---|---|
| Hosting | CLOUDFLARENET - Cloudflare, Inc., US |
| Country | US |
| Server IP | 2606:4700:3031::6815:3d55 |
| Name servers | daisy.ns.cloudflare.com, grant.ns.cloudflare.com |
| CDN / edge network | Detected (cloudflare) |
| Resolved IP addresses | 4 |
| Edge IP addresses | 4 |
| Likely origin IP addresses | 0 |
| SSL issuer | WE1 |
| SSL expiry | 2027-01-10 |
| Domain age | 0.20 years (continuous registration) |
| Domain expiry | 2027-08-14 |
| Archive first seen | Not available |
| Archive snapshots | Not counted (archive lookup incomplete) |
| Reputation | VirusTotal: 12 flagged | AbuseIPDB: 0% confidence, 0 reports | Google Safe Browsing: 0 matches |
About this assessment
A trust score summarises the evidence TrustSniffer could collect about rtxtoken.info at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.
TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.