Is solstreamer.xyz a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This is a newly registered website on the low-cost .xyz domain solstreamer.xyz. Its apparent purpose could not be established from its own content, because a visitor is stopped at a Cloudflare security interstitial titled as a suspected-phishing warning. That page shows no products, services, or business model, so the site presents no verifiable commercial function.

Scam/Impersonation Risk

This is a confirmed adverse reputation case. Several major security vendors, including multiple top-tier ones, independently classify the domain as malicious, and it is blacklisted. The interstitial served at the site's entry point carries a suspected-phishing designation. The pattern is consistent with a disposable, recently stood-up domain used for deceptive or malicious purposes, not with a dormant or misconfigured benign site. No brand impersonation and no conflicting legal identities were established, because no identity pages could be read. The risk therefore rests on the reputation and phishing signals, not on identity contradictions. In the automated browsing sessions, the site's pages made heavy use of external requests and POST submissions, produced repeated script errors, and showed large DOM changes after interaction. These patterns fit a page that loads content dynamically from third-party origins. Wallet-connection, wallet-draining, and clipboard-hijacking behaviours were not observed, and no hidden or externally-posting password forms were detected. Those absences do not reduce the severity of the external detections. Evidence:

• Homepage: access returned a 403 bot-challenge page titled as a suspected-phishing warning, so no site content could be inspected.
• External reputation: 11 security engines flagged the domain as malicious and 2 as suspicious. Three top-tier vendors (Fortinet, Kaspersky, Sophos) are among the detections, and the blacklist condition is confirmed.
• Domain provenance: registered 2026-08-17 (~0.19 years, about 69 days old), so there is no operating history to offset the detections.
• Behavioural sessions (3 of 3 completed): 64 external XHR/fetch calls, 9 external POSTs, 21 console errors, and a peak of 1,523 DOM mutations after interaction.

Regulatory Verification Notes

No legal, licensing, or corporate-registration disclosure could be read, because the site's pages are not reachable behind the interstitial. The site therefore offers no regulator reference, legal entity, or terms of service on which a licensing assessment could be based. Ownership and governance are opaque, and the registration record does not identify a clear operator. The identity of the party behind the domain therefore remains unknown. No third-party broker or regulatory-database match exists for the name, so there is no independent reputational or licensing context. This section records the absence of any identity anchor and does not itself establish fraud. The detections in the section above carry that weight. Evidence:

• Registrar: Global Domain Group LLC; registration created 2026-08-17 and set to expire 2027-08-17, a one-year term with no multi-year commitment.
• Hosting network: AS13335 (Cloudflare, Inc., US).
• Transport encryption: TLS certificate issued by WE1, domain-validated (DV) only, valid to 2027-01-14. DV confirms control of the domain and says nothing about the operator's identity.
• Broker database: no WikiFX-style broker match, so no external regulatory or reputational context is available.

What to Verify Next

Before any engagement, the domain should be treated as untrusted until the security detections are independently cleared. Check the domain against several independent reputation and phishing-reporting services, and compare their results with the current detections. If the domain was reached through a link, message, or advertisement, trace that source and treat it as suspect. Do not contact the site's operators through any channel the site itself provides. Confirm any claimed affiliation or service only through an independent, offline route, such as a known official channel of the organisation the site purports to represent. If a legitimate operator exists, the domain should be re-assessed only after the operator is named, the warning is lifted, and the page content is publicly reachable. Evidence:

• Entry page: the suspected-phishing interstitial currently blocks access, so no claims can be checked against content.
• Domain age: the domain is about two to three months old, so no history exists to cross-check.
• Reputation: the detections are current, so any later change in status should be confirmed against fresh results.

Summary Verdict

The overall posture is critical and clearly cautionary. Confirmed adverse security detections and a phishing designation dominate the assessment. The very recent registration, the lack of any readable operator or business content, and the heavy third-party request activity add to it. Nothing in the evidence offsets these findings. Valid encryption and a hardened edge are baseline hygiene that malicious sites commonly share.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and WAF, and every observed address is a CDN edge, so the origin server is not visible. Bot-challenge protection is active. This setup is common to legitimate and malicious sites alike. It is a mitigating factor only and cannot offset the detections above. The edge-only visibility prevents independent verification of where the content is actually hosted, and it could allow content to be swapped quickly. A heuristic notes that the domain is young with sparse subdomains, but this is unconfirmed and adds little beyond the main findings.

Closing Assessment

Treat the site as unsafe for any login, credential entry, wallet connection, or financial interaction, and do not download anything from it. If the domain was received through an unsolicited message or advertisement, avoid opening it again and report it to the platform or channel through which it arrived. Any interaction with the site should be limited to passive observation from an isolated environment.