Is stonk-campaign.com a scam? TrustSniffer's high-risk assessment: 0/100

Overview

This website is a single-page landing site titled "STONK | Community Airdrop Claim · Solana". It presents itself as a community token airdrop claim portal in the Solana ecosystem and is built around the idea that a visitor can claim a free token allocation. Its apparent purpose is to funnel visitors into a claim flow, a model that is common to promotional campaigns and also to wallet-targeting and credential-harvesting schemes.

Scam/Impersonation Risk

Contradictory signals are present. Several independent threat-intelligence engines currently flag the domain as malicious or suspicious, and an external blacklist listing is also active, so the domain is blacklisted by third-party sources. The domain is also only weeks old. It was registered shortly before this assessment and has no established operating history. That combination is a recognised pattern for disposable campaign sites. The homepage frames itself as a "community airdrop claim" on Solana. Offers of free tokens on freshly registered domains are a standard lure for wallet-connection prompts, seed-phrase requests, and approval-based asset drains. The behavioral sandbox did not trigger a wallet connection, a clipboard hijack, a hidden form, or an external password form. Those clean results do not outweigh the reputation findings, because a claim flow may only activate for a real, interactive wallet session. The sandbox did record that nearly all network activity on the page went to external destinations. It logged dozens of external requests, including background data fetches and POST submissions. None of these went to unrecognised hosts, but the volume points to a page that is mainly a shell for third-party content. A dozen browser console errors also indicate an unpolished or hastily assembled build. No conflicting legal entities or brand-impersonation evidence was identified. The risk here comes from reputation and the profile of the site, not from identity conflicts. Evidence:

• Homepage: titled as a community airdrop claim on Solana, with the claim mechanic as its central proposition.
• Reputation checks: three engines rated the domain malicious and one rated it suspicious, alongside an active external blacklist entry.
• Domain provenance: registered 2026-09-11 (~0.11 years, ~40 days old).
• Sandbox behavior: 27 external background requests and 9 external POSTs across three runs, with 97.6% of observed requests going to external hosts and 12 console errors.

Regulatory Verification Notes

The site presents no regulated financial service, and no third-party regulatory registration was found. The airdrop framing does not reference any licensed entity, legal terms, or named operator on the captured homepage. A missing license is not by itself evidence of fraud, but here it sits alongside confirmed reputation findings, so the lack of any accountable counterparty is material. The domain is registered through the commercial registrar NameSilo, LLC, with the registrant details held behind a privacy service. This is treated as an administrative detail and not as a contradiction. The site's transport encryption is valid but carries only domain-level validation, which proves control of the domain and says nothing about the operator's identity or intent. No broker-reputation dataset matched this site, so no external sector-specific reputational context is available. Evidence:

• Registration: domain registered through NameSilo, LLC, with the registrant shown as a privacy-protected account.
• Transport encryption: TLS certificate issued by YE1 (DV), valid to 2026-12-10, with a domain-validation-only trust level.
• Hosting: served from AS13335 (CLOUDFLARENET - Cloudflare, Inc., US).
• Homepage: no named legal entity, license, or registration number appears in the captured content.

What to Verify Next

Any claim that this campaign is tied to the STONK token or its community should be checked against the token project's own channels, reached by independent navigation and not through links on this site. The airdrop's legitimacy should also be confirmed there, including the official claim address, if one exists. Reports of this domain from other users, wallet-security communities, and token-tracker listings should be checked before any interaction. Any wallet that has already interacted with the site should be reviewed for token approvals, and any unwanted approvals revoked. Prospective users should also confirm that the project publishes legal terms and a named operator elsewhere. Evidence:

• Homepage: the claim proposition cannot be matched to any verified project source from the captured content.
• Domain age: the site's recent registration means no long-standing public record exists to corroborate it.
• Sandbox: the lack of observed wallet activity means the claim flow's true behavior remains untested.

Summary Verdict

The available evidence supports a clearly high-risk posture. Active third-party threat detections, together with a very new domain and a promotional claim model, outweigh the technically sound surface of a valid certificate and a stable, responsive page. The site's legitimacy is unverified and its risk profile is elevated.

Infrastructure Integrity

The site is delivered through Cloudflare's CDN and web application firewall, and all four observed edge addresses (two IPv4 and two IPv6) belong to that network. The origin server could not be observed, which prevents independent verification of where the content is actually hosted and allows content to be swapped quickly without any visible change in infrastructure. The CDN and the bot-protection layer are mitigating factors in the sense that they show the site is behind mainstream, well-run infrastructure. They do not vouch for the operator and cannot offset the reputation findings. The domain's sparse subdomain footprint, combined with its youth, is only an unconfirmed heuristic and carries no weight here.

Closing Assessment

The site should be treated as read-only at most. Wallet connections, transaction approvals, seed-phrase entry, credential submission, and any payment should be avoided entirely. Any claim should be pursued only through channels verified independently of this domain.