Is scfraft.com safe? TrustSniffer's low-trust assessment: 25/100

Overview

This website is a single-page crypto token airdrop portal branded "shitcoin". It invites visitors to connect a Solana wallet and claim free SHITCOIN tokens before a seven-day countdown ends. The page presents itself as a Solana-based DeFi project with platform, resources and legal menus. Its apparent purpose is to attract wallet connections and community engagement through a limited-time token giveaway, and it states no funding or revenue model.

Scam/Impersonation Risk

No contradictions were observed in the formal sense. No threat-intelligence source flags the site, no phishing or brand impersonation was detected, and no conflicting legal identities appear, because the site names none at all. The content, however, carries clear deception-oriented characteristics that call for caution. The homepage text is deliberately obfuscated with look-alike (homoglyph) characters and invisible zero-width characters, which can defeat keyword filtering and brand matching and is not ordinary formatting. The airdrop mechanics combine several pressure and eligibility devices: a seven-day countdown, a "limited time opportunity for early adopters" appeal, and requirements to hold tokens in the connecting wallet and follow a social account. The headline figures are a pool of 1,000,000 tokens, 50,000 participants, a token price of $0.000003, "$2.5M total volume", "150K+ active users" and "24/7 support". These claims sit beside "revolutionary DeFi project" and "join millions of users" language. For a page that has existed only days, none of it is supported by a verifiable contract address, audit, team, product or support channel. The footer links to a whitepaper, roadmap, tokenomics, trading and staking pages, but the captured page shows no contact channel or contract details to back them. The page also does not explain how the project is funded or how the token holds value. In the behavioral sandbox runs, no wallet-draining routine, clipboard manipulation or hidden form submission was observed. That is a mitigating observation about what the page did in testing, not evidence that a wallet connection is safe. Evidence:

• Homepage: the visible text mixes look-alike and zero-width characters throughout the title, headings, buttons and footer, and a seven-day countdown sits beside the "Claim Tokens" and "Connect Wallet" prompts.
• Homepage: the stat counters (1,000,000 tokens, 50,000 participants, $2.5M volume, 150K+ users) have no contract, explorer link, audit or named team behind them.
• Domain provenance: registered on 2026-10-07 (~0.03 years, about 12 days old), and the web archive holds 2 snapshots, both captured on 2026-10-08 (1 year tracked).
• Sandbox behavior: three of three runs loaded successfully and showed no cloaking, hidden forms or wallet-drainer activity.

Regulatory Verification Notes

The page lists a legal section (privacy policy, terms of service, cookie policy, disclaimer) in its footer. It names no legal entity, jurisdiction, registration number or licensing authority. It is not presented as a regulated financial service, and no third-party reputational record for it was found. Offering and distributing a crypto token to the public can carry securities, consumer-protection and financial-promotion obligations in many jurisdictions. The site makes no statement about any of them. This is a verification gap, not proof of wrongdoing. A DV-grade encryption certificate and a clean reputation record show only that the site is technically well formed and not yet reported. They do not establish who operates it. Evidence:

• Homepage footer: legal, privacy, terms, cookie and disclaimer links appear, but the captured content identifies no operating company, address or regulator.
• Homepage: the copyright line names only the brand "shitcoin", with no legal entity.
• Transport security: the TLS certificate is DV-validated, issued by YE2 and valid to 2027-01-05.
• Network: served from AS13335 (Cloudflare, Inc., US); domain registered via PDR Ltd. d/b/a PublicDomainRegistry.com, expiring 2027-10-07.

What to Verify Next

Before connecting a wallet or acquiring the token, a prospective participant should look for the token's contract address. It should be confirmed independently on a public Solana block explorer, including mint authority, holder distribution and liquidity, rather than through links on the page. The project's claimed social account and team should be checked for history that predates the domain's registration. Any claim of "$2.5M volume" or "150K+ users" should be tested against independent on-chain data. Official support and contact channels should be confirmed through an independent route. If any wallet interaction is considered, a separate low-balance wallet with no other assets and no standing token approvals limits the exposure. Evidence:

• Homepage: eligibility rules require holding tokens in the connecting wallet and following a social account, so identity and approval checks can be done before connecting.
• Homepage: no contract address is shown, so on-chain details must be sourced externally.
• Domain provenance: the domain is about 12 days old, so any claimed project history should be traceable to dates after 2026-10-07.

Summary Verdict

The available evidence supports a low-trust posture. The site is technically well formed and has no confirmed external threat listing. Its content shows consistent claim-versus-evidence gaps, very recent origin and deliberate text obfuscation, and its operator identity is unverified. Legitimacy cannot be inferred from the evidence collected, and the site reads as an unestablished token promotion.

Infrastructure Integrity

The site is delivered through Cloudflare's CDN/WAF, and all four observed addresses (two IPv4, two IPv6) are Cloudflare edge servers. The origin server was not observable. This is a mitigating factor, since the infrastructure is mainstream and the shared network has no abuse reports and a clean reputation. It is not evidence of legitimacy. Edge-only visibility also means hosting cannot be independently verified, and content can be changed quickly without any visible change in network location.

Closing Assessment

Treat the page as an unverified promotion. Do not connect a wallet, approve token permissions or move meaningful funds until the project's contract, team and claims have been independently confirmed. Ordinary browsing of the page carries little technical risk.