Is streambridgehub.xyz a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

Streamflow-branded web page, served from the domain streambridgehub.xyz, that presents itself as a Solana token distribution platform. It offers token vesting schedules, airdrops, staking pools and token locks through a web application and developer SDK. The homepage invites visitors to connect a crypto wallet to claim token rewards and "pump.fun creator fees". It also carries enterprise "Book a demo" calls to action. Its apparent business model is paid token-distribution tooling and white-label services, but no pricing is disclosed.

Scam/Impersonation Risk

The deciding factor is a confirmed external threat listing. At least one major security vendor flags the domain as malicious, and further engines rate it suspicious, so the domain is blacklisted on external reputation sources. No phishing or brand-impersonation finding was made, and no conflicting legal identities appear. The elevated risk comes from the listing, together with the profile of the site itself. The homepage runs a wallet-connect claim portal for "pump.fun creator fees or token rewards". It states the lookup is "non-custodial · read-only" and that nothing is signed until the user confirms. These assurances cannot be independently tested and sit alongside an unverified audit claim and vague quick-action links. The page asserts that it is "Trusted by the best Solana projects", lists names such as BONK, Mad Lads, Wormhole and io.net, and shows headline counters of "$411M+" TVL, "1.3M+" users and "40K+" projects. None of this is substantiated on the page. The claim flows, the staking amount input and a mock airdrop of "0.002 Bonk" to "1,597" recipients all lead toward irreversible token transfers. The page displays Streamflow branding on a domain that does not carry that name, and no relationship between the two is demonstrated. This is not a confirmed impersonation finding, but the mismatch is material for a site soliciting wallet connections. Fee-claim lures of this kind are a common pattern in wallet-draining campaigns. Evidence:

• Homepage: wallet-connect prompt and a claim portal for pump.fun creator fees, with a "Claimable balance" display and a "Claim fees" button.
• Homepage: unverifiable social-proof claims, including partner logos and TVL, user and project counters.
• Domain registered 2026-09-19 (~0.08 years, about 31 days old), so there is almost no operating history behind the claimed scale.
• External reputation sources: one malicious and two suspicious detections, and the domain is listed on an external blacklist.

Regulatory Verification Notes

The homepage names no legal entity, registered address, licence or regulator, and its audit claim cites no auditor or report. Because the site handles token distribution and staking flows that move value between wallets, these missing disclosures are significant. They are treated as verification gaps, not as proof of wrongdoing; the blacklist listing is what drives the cautionary verdict. Registration details give no independent link to the Streamflow brand, so the real-world operator remains unverified. No third-party broker or regulatory database entry matched this site. Evidence:

• Homepage: no company name, licence number, regulator or physical address, and an audit claim with no named auditor.
• Registrar: NICENIC INTERNATIONAL GROUP CO., LIMITED; registration runs to 2027-09-19.
• TLS certificate issued by YE1 (domain-validated only), valid to 2026-12-18, so it confirms encryption but not who operates the site.
• Served from AS13335 (Cloudflare, Inc., US); the 1 archive snapshot, first and last seen 2026-09-19, shows no prior history.

What to Verify Next

The relationship to the genuine Streamflow project should be confirmed through that project's own official channels, reached independently of this site. These include its established documentation and verified social accounts. Any claimed audit should be checked directly with the named auditor. Before any wallet is connected, the claim portal's contract addresses and requested permissions should be compared against the official project. Official support and contact channels should also be confirmed through an offline or independent route. Evidence:

• Homepage: Streamflow branding and a "Book a demo" call to action, with no verifiable corporate identity.
• Homepage: audit assertion with no auditor or report reference.
• Claim portal: references to specific tokens (STREAM, BONK, SOL, ADNS) whose official contract addresses can be checked independently.

Summary Verdict

The site carries an elevated, high-risk posture. External threat detections are decisive, and nothing else in the evidence offsets them. Identity and legitimacy remain unverified, and the content profile points toward sensitive financial interaction. The assessment is clearly cautionary.

Infrastructure Integrity

The site is fronted by Cloudflare's CDN and WAF, and the observed addresses are all edge servers, so the origin host cannot be examined independently. The TLS certificate is valid, and the bot-protection layer was seen during behavioural testing. These are mitigating factors only. Edge-only visibility also limits independent hosting verification and can mask rapid content changes. Shared protective infrastructure cannot offset the external threat listing.

Closing Assessment

Treat the site as unsafe for login, credential entry, wallet connection or any financial transaction. Limit any interaction to passive, read-only viewing, and do not approve transactions or sign messages from this domain. Anyone who has already connected a wallet here should review and revoke its permissions.