Is tashiperk.xyz a scam? TrustSniffer's high-risk assessment: 12/100

Security Alert

Fortinet flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website operates under the title "Tashi DePIN Network" on a very recently registered .xyz domain. It presents itself as a decentralized physical infrastructure (DePIN) network project. Automated visitors received only a minimal landing page behind a bot challenge, so no specific products, token mechanics, or yield claims could be read from the captured content. The site's commercial model therefore cannot be established beyond its self-description as a crypto-infrastructure network.

Scam/Impersonation Risk

Confirmed contradictions are present. The domain is blacklisted by external threat intelligence: a major security vendor classifies it as malicious, and further engines rate it suspicious. This is the decisive factor in the assessment. No conflicting legal identities, brand impersonation, or phishing-page content were observed. The risk rests on the external listing, not on anything read from the page. The listing is made more serious by the domain's extreme youth, since it was registered only weeks ago. It also carries a name that evokes an existing crypto-network brand, so it fits the profile of a short-lived domain set up to attract onboarding traffic. The site's browser behaviour was mostly unremarkable. Its network traffic went overwhelmingly to third-party endpoints, and none of those endpoints were unrecognized. No wallet-connection prompts, clipboard manipulation, hidden forms, or external password forms were observed. This does not offset the external listing, because the site's functionality was not fully exposed to analysis. Evidence:

• Homepage, external reputation: one major security vendor flags the domain as malicious and two further engines rate it suspicious, which produces the confirmed listing.
• Domain registration: registered 2026-09-17 (about 0.09 years, roughly one month old), with expiry set for 2027-09-17.
• Archive record: 1 archive snapshot, captured 2026-09-18, covering a single year of tracked history.
• Homepage behavioural testing: 27 external data requests and 9 external form submissions, all to recognized destinations, plus 9 browser console errors and no wallet-connect, clipboard or hidden-form activity across 3 successful runs.

Regulatory Verification Notes

The captured homepage content, about 264 characters, names no operating company, registered address, licensing authority, or registration number. No legal or terms pages were available for review. This is a disclosure gap on the pages that were captured, not proof of wrongdoing. It leaves nothing on the site that can substantiate the identity of the operator behind a project that solicits participation in a crypto network. No third-party broker or regulatory-database match was found for the site, so no reputational or licensing signal exists in either direction. The operator's real-world identity remains independently unconfirmed, and the site's self-description cannot be treated as evidence of legitimacy. The registrar is a commercial provider, and the transport-encryption certificate is a basic domain-validated one. Both are common to legitimate and abusive sites alike, so neither adds assurance about the operator. Evidence:

• Homepage: the captured content contains no named legal entity, license, or registration details.
• Domain registration: registered through NICENIC International Group Co., Limited, an ordinary commercial registrar.
• Transport encryption: TLS certificate issued by YE2, domain-validated (DV) only, valid to 2026-12-16 (55 days remaining).
• Hosting: served from AS13335 (CLOUDFLARENET, Cloudflare, Inc., US).

What to Verify Next

No interaction with the site should rely on its own claims. Any association with the genuine Tashi network or a comparable DePIN project should be tested by locating that project's official channels through independent routes, such as an established aggregator, the project's known social accounts, or direct contact with the project team. The domain should be checked against those official channels to see whether it is endorsed or merely imitates them. Any claimed licensing or corporate registration should be confirmed with the relevant registry, not through links on the site. Support and contact details should be confirmed offline before any exchange of information. If the site later exposes wallet, staking, or onboarding functions, the domain's external listing should be rechecked before any further interaction. Evidence:

• Homepage: the title presents a DePIN network brand, but the captured content offers no verifiable link to an official project.
• Domain registration: the site is about one month old, so no track record exists to rely on.
• External reputation: the current vendor listing means any later change in status should be confirmed before the site is reconsidered.

Summary Verdict

The overall posture is high-risk. A confirmed external blacklisting is compounded by a brand-new domain and the absence of any verifiable operator identity. Supporting technical hygiene, such as a valid certificate and stable page responses, is routine and does not change that posture. The site cannot be treated as trustworthy for any sensitive purpose.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and WAF. All four observed addresses are edge servers, and the origin server was not observable. Bot-protection challenges are active. This protection reduces the site's exposure to commodity attacks, but it is only a mitigating factor. It also prevents independent confirmation of the real hosting location, and it cannot offset the external reputation listing. The domain is young with sparse DNS structure, which is an unconfirmed indicator that fits a recently stood-up property and carries no weight on its own.

Closing Assessment

The site should be limited to passive viewing at most. Account logins, credential entry, wallet connections, and any financial transaction should be avoided, and nothing should be downloaded from it. Anyone who encountered it through a link, message, or advertisement should disregard that invitation and reach any genuine project only through channels they have verified themselves.