Verdict
sherpaclimbing.com shows high-risk / scam indicators.
This assessment found strong scam indicators. Do not pay, sign in, or share personal details with this site.
| What this site appears to be | Website for Sherpa Climbing, a Nepal-based trekking and expedition operator offering peak climbing, treks, city tours, and contact details (phone, email, address). Content lists itineraries and trip durations; appears informational and commercial for booking trips. |
|---|
Evidence status and limitations
Evidence completeness: UNKNOWN
- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.
At a glance
The checks that decide most of this verdict.
| Malware engines | 11 flagged itVirusTotal | Risk |
|---|---|---|
| Google Safe Browsing | Not listedGoogle | Clear |
| Abuse reports on the host | 0 reportsAbuseIPDB; shared hosting inflates this count | Noted |
| Domain age | 19 years oldRegistered history | Clear |
| Web archive | Archived since 2007Public history exists | Clear |
| Certificate | Encrypted connectionIssued by WE1 | Noted |
The page as captured
Key findings
- Automated classification: Sensitive Interaction Risk.
- Domain age: more than 10 years (registration continuity).
- Public web-archive history exists since 2007.
- At least one reputation service TrustSniffer consulted had flagged this domain at assessment time.
Full analysis
Security Alert
Fortinet, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.
This website presents Sherpa Climbing as a Nepal-based travel and adventure operator offering trekking, peak-climbing, expedition, and city-tour itineraries, with an apparent business model based on direct trip enquiries and bookings.
Scam/Impersonation Risk
The site’s visible content is consistent with a conventional travel operator and page analysis found no apparent phishing form, brand impersonation, or deceptive on-page feature. However, this benign presentation is outweighed by a confirmed blacklist finding and multiple external malicious detections, including Tier-1 security detections. Behavioral telemetry also marked network activity and final-destination handling as suspicious, although the page rendered successfully and no hidden sensitive forms were observed. The result is a material risk to credential submission, payment, and booking interactions; the website’s apparent travel purpose does not resolve the external threat contradiction.
- The domain registration record shows creation on 2007-06-11 and an age of 19.2 years.
- Historical archive records show 105 snapshots from 2007-08-28 through 2025-03-20, spanning 19 tracked years.
- External reputation evaluation recorded 11 malicious detections and a confirmed blacklist hit.
- Behavioral inspection recorded 10 external XHR requests, 6 external POST requests, 5 console errors, and 2 successful runs.
Regulatory Verification Notes
The site’s pages describe trekking, peak climbing, expeditions, and city tours in Nepal, but the supplied content does not state a tourism license, registration number, or licensing authority. The domain registration record identifies Phaden Kaji Sherpa and the organization “Sherpa Climbing”; nevertheless, the available evidence does not independently verify that this registrant is the operating entity behind the website. The absence of a broker-dataset match provides no regulatory conclusion, and the external blacklist finding remains a security signal rather than a legal determination.
- The registration record lists PDR Ltd. d/b/a PublicDomainRegistry.com as registrar and identifies Phaden Kaji Sherpa / Sherpa Climbing as registrant details.
- Server telemetry identifies AS13335, CLOUDFLARENET – Cloudflare, Inc., US; infrastructure resolution also identifies AS18222, DATAHUB-AS-AP – Data Hub Pvt. Ltd., NP.
- The site’s transport encryption uses a DV TLS certificate issued by WE1, valid to 2026-10-09.
- The homepage and service pages contain itinerary and booking-oriented content but no stated license number or licensing authority.
What to Verify Next
Before any sensitive interaction, an independent party should confirm Sherpa Climbing’s legal operating identity and applicable Nepal tourism or expedition permissions through relevant official registries. Payment beneficiary details should be matched to the independently confirmed entity, and contact channels should be validated through an offline or independently sourced route rather than relying solely on website-provided details. Until those checks are complete, activity should remain limited to passive viewing and non-sensitive enquiries.
- The contact page provides phone, email, and address details suitable for an independent identity cross-check.
- The captured homepage contained no login form, hidden form, or sensitive payment form.
- The site presents specific itineraries, including Everest expeditions, Base Camp treks, and multi-day regional routes, which can be matched against independently obtained business information.
Summary Verdict
The overall posture is critical and unsuitable for sensitive interaction. The site has a plausible travel-business presentation, but the confirmed external threat detections and blacklist status create a decisive trust concern, while the real-world operator identity remains unverified.
Infrastructure Integrity
Cloudflare CDN/WAF protection provides a mitigating layer against direct exposure of the service infrastructure. Observed addresses were CDN edge servers, and no origin-server candidate was identified in the infrastructure assessment; this protection supports resilience but does not establish legitimacy or offset the external reputation findings.
Closing Assessment
Sensitive actions should be deferred unless independent business, licensing, payment, and contact verification are completed through trusted external channels.
Written analysis generated 2026-08-20 by the TrustSniffer Analysis Engine from the evidence in this report.
What the analysis found
1 finding contributed to this verdict, raised by analysis engine, behaviour in a sandbox, external reputation.
01 Sensitive Interaction Risk
- The analysis matched a pattern TrustSniffer treats as a direct threat to a visitor.Analysis engine
signal:direct_threat - A large share of what the page loaded came from other domains.Behaviour in a sandbox
rule:BEHAV_EXTERNAL_RATIO_MODERATE - An external threat feed lists this domain: either Google Safe Browsing marked it malicious, or a significant number of malware engines flagged it.External reputation
rule:EXT_BLACKLIST_CRITICAL
Identity verification
| Status | UNVERIFIED |
|---|---|
| Identity score | 30/100 |
| Identity verification confidence | 50% |
- No on-site identity signals detected
Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence.
What TrustSniffer observed
First-party facts recorded during the assessment of sherpaclimbing.com.
- The request stayed on sherpaclimbing.com. It was not redirected to another domain. Clear
- Registration is published under PDR Ltd. d/b/a PublicDomainRegistry.com. Clear
- DNS for this domain is served by cloudflare.com, across 2 name servers. Noted
- The registration is paid up to 2027-06-11. Noted
- The earliest public archive of this site is from 2007-08-28. Clear
- It is hosted on CLOUDFLARENET, from a server in US. Noted
Domain intelligence
| Registrar | PDR Ltd. d/b/a PublicDomainRegistry.com |
|---|---|
| Hosting | CLOUDFLARENET - Cloudflare, Inc., US |
| Country | US |
| Server IP | 2606:4700:3037::6815:3a0d |
| Name servers | NORA.NS.CLOUDFLARE.COM, STAN.NS.CLOUDFLARE.COM |
| SSL issuer | WE1 |
| SSL expiry | 2026-10-09 |
| Domain age | 19.20 years (continuous registration) |
| Domain expiry | 2027-06-11 |
| Archive first seen | 2007-08-28 |
| Archive snapshots | Not counted (archive lookup incomplete) |
| Reputation | VirusTotal: 11 flagged | AbuseIPDB: 0 reports | Google Safe Browsing: 0 matches |
About this assessment
A trust score summarises the evidence TrustSniffer could collect about sherpaclimbing.com at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.
TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.