Is thoreum-capital.pages.dev a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

THOREUM Capital is a single-page crypto token promotion site that sits on a free pages.dev subdomain. It presents the THOREUM token as an "AI Powered Store of Value & Hyper Deflationary Token", with prominent calls to connect a wallet, buy through an "Instant Bond", migrate, or claim. Its apparent business model is to draw deposits into token bonding and a "Thoreum Bank" yield scheme. Returns are said to come from token demand and revenue sharing across an unverified ecosystem.

Scam/Impersonation Risk

The domain is blacklisted, and the blacklisting is the decisive finding. Several independent security engines, including a tier-one engine, currently flag the domain as malicious, and the aggregated external reputation check confirms the listing. No brand impersonation, phishing form, or conflicting legal identity was observed. The risk comes from the offer itself and from the external detections. The homepage promises an "Extra 10%++ profit" on the Instant Bond, "Thoreum Bank" APY of up to 200%, and projected x100 gains. It also uses "Sure Bet" language and says the token will "probably catch BTC this year". These are guaranteed-return and aggressive-yield claims, and the page asks for deposits before any service is delivered. The pressure tactics include a countdown timer, "Limited offer!" banners, and a wallet-connect prompt. The page names Certik and Paladin as auditors without linking to any report. It also claims 50% revenue sharing across an ecosystem without showing where the money comes from. The burn narrative contradicts itself. The page announces that the 1% daily supply burns ended on 17 March 2024, yet it still advertises "99.99% supply burned" and "Hyper Deflationary" status. This is a claim-versus-evidence mismatch typical of high-yield investment programmes. Nothing in the evidence shows that wallet-draining or clipboard-hijacking behaviour occurred during sandbox runs. The financial mechanics and the confirmed external detections are the primary hazards. Evidence:

• Homepage: promises a 10% instant bond profit, APY up to 200%, and x100 projections alongside a countdown timer and "Limited offer" urgency.
• Homepage: lists Certik and Paladin audits and ecosystem payouts with no verifiable report or link, and contradicts itself on whether burns have ended.
• Domain provenance: a roughly 2.2-year-old pages.dev subdomain, with 16 archive snapshots spanning 2024–2026 (3 years tracked).
• External reputation: four security engines rate the domain malicious, including one tier-one engine, and the domain appears on a confirmed external blacklist.

Regulatory Verification Notes

The site shows no legal entity name, licence, registration number, physical address, or contact channel. It also carries no risk disclosure, even though it solicits token purchases and yield deposits. Beyond the missing disclosures, the domain is a free-hosting subdomain with no independently identifiable owner, so the real-world operator cannot be connected to the offer. The site gives no basis for treating it as a regulated activity. No third-party broker or regulator database match was found, and that absence is not a reputational finding in itself. Because the blacklist hits and the guaranteed-return promises are present, these gaps compound the concern. They are not minor administrative omissions. Evidence:

• Homepage: no company name, licence authority, registration number, address, or complaints route is presented anywhere on the page.
• Homepage: investment-style claims appear with no risk warning or terms of participation.
• Hosting: served from AS13335 (Cloudflare, US), and the TLS certificate is DV-level, issued by WE1 and valid to 2026-12-10.

What to Verify Next

Any claim of auditing should be confirmed directly with the named audit firms through their own official publications, because the site provides no report links. The token's actual contract, supply, and burn history should be checked on an independent blockchain explorer. The explorer data should be compared with the "99.99% burned" claim and the announcement that burns ended in March 2024. The operator's identity and any licence should be confirmed with the relevant financial regulator's public register in the user's jurisdiction. Official communication channels should be identified through independent, offline routes, not through links on this page. Evidence:

• Homepage: the audit and ecosystem-payout claims carry no verifiable references.
• Homepage: the contradictory burn statements can be tested against on-chain data.
• Legal and contact information: nothing on the page can be traced back to an identifiable operator.

Summary Verdict

The available evidence points to a high-risk, untrusted site. Confirmed external detections and a guaranteed-return investment model drive that assessment. Technical hygiene does not offset the risk, and the operator's real-world identity remains unverified. The site is classified as unsafe for any financial or credential-based interaction.

Infrastructure Integrity

The site is delivered through Cloudflare's CDN and WAF. All four observed IP addresses are edge servers, and the origin host was not observable. This protective layer is a mitigating factor only and says nothing about the legitimacy of the operator. The edge-only view also prevents independent verification of the real hosting and allows content to be swapped without notice. The infrastructure therefore cannot offset the reputation risk from the external detections.

Closing Assessment

The site should be treated as hostile. Wallets should not be connected, no funds should be sent, and no tokens should be bought, bonded, or migrated through it. Read-only viewing is the only reasonable use. Anyone who has already interacted with it should review and revoke wallet permissions and seek independent advice.