Is tokencitrea.xyz a scam? TrustSniffer's high-risk assessment: 5/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

tokencitrea.xyz is a recently registered website on the low-cost .xyz extension. Its name suggests a cryptocurrency or token-related offering. Visitors reaching the homepage are shown a security interstitial instead of ordinary product content, so the site presents no readable business proposition, and its apparent purpose and business model cannot be established from its own pages.

Scam/Impersonation Risk

This is the decisive area of concern. Multiple independent security engines currently flag the domain as malicious, including several top-tier endpoint-security vendors, and the aggregate detection level is high enough to constitute a confirmed blacklisting. The homepage that visitors receive is a protection-provider warning page titled as a suspected phishing site, which is consistent with those detections. No conflicting legal identities and no specific brand impersonation were observed, so the risk rests on the reputation and phishing-classification signals rather than on identity contradictions. Behavioural testing found no wallet-drainer activity, clipboard manipulation, hidden forms, or credential forms posting to outside parties. However, the page generated heavy traffic to third-party hosts, a high share of its requests went to outside parties, and it produced a large number of browser console errors, which is an unstable and externally dependent footprint. Because the site's content could not be viewed, no product or yield claims could be assessed. The absence of observed drainer behaviour therefore does not offset the blacklist findings. Evidence:

• Homepage: the page served to visitors carries a "suspected phishing" interstitial title from the protection provider and is blocked behind a challenge.
• Reputation: several leading security vendors independently classify the domain as malicious, and an external blacklist listing is active.
• Behavioural testing (three runs): no wallet-connection, drainer, clipboard-write, or external password-form activity; heavy third-party request volume and repeated console errors.
• Domain provenance: registered 2026-05-11 (~0.46 years old), with only 5 archive snapshots spanning 2026-05-16 to 2026-07-03 (1 year tracked), so the domain has almost no history.

Regulatory Verification Notes

No licensing, registration, or legal-entity information could be read on the site, and the state of its on-page disclosures is unclear. Ownership and governance are opaque. Registration details do not identify an accountable operator, and nothing in the evidence independently ties the site to a real-world person or company. This is ownership opacity, not an identity contradiction, but together with a very young domain and the reputation findings it leaves no counterweight. No third-party broker or regulator record corresponds to this site, so there is no external regulatory standing to rely on. Evidence:

• Registration: the registrar is Global Domain Group LLC, expiring 2027-05-11, and the registrant details are incomplete.
• Transport security: TLS certificate issued by WE1 (DV, domain validation only, which does not establish operator identity), valid to 2026-12-05.
• Hosting: served from AS13335 (CLOUDFLARENET, Cloudflare, Inc., US).

What to Verify Next

Before any interaction, confirm independently whether the site claims an affiliation with an established token project or platform. This should be done through that organisation's own official channels, not through links or contacts found on this site. Any claimed licence or registration should be checked directly with the relevant registry, and the official support and contact channels should be confirmed by an independent route. The domain's reputation should be re-checked later, since a listing caused by a compromise would be expected to clear only after remediation. Evidence:

• Homepage: no readable operator, licence, or affiliation statement was available to anchor a check.
• Domain history: the very short registration and archive record means there is no long operating track record to rely on.
• Reputation: the active security-vendor detections are the condition that would need to clear before any reassessment.

Summary Verdict

The assessment is critical and clearly cautionary. Confirmed blacklist-level detections from multiple security vendors, a phishing-style warning on the landing page, and a brand-new, unattributed domain converge into a high-risk posture. The technical hygiene observed does not mitigate this posture.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and WAF, with a valid DV certificate from a recognised issuer. All observed addresses are CDN edge servers, and the origin server was not observable. This protective layer is a mitigating factor only. It shows that the traffic path is professionally fronted, but it says nothing about the operator's intent, and it cannot offset the reputation findings.

Closing Assessment

Prospective users should not log in, enter credentials, connect wallets, or make any payment or financial commitment on this site. Passive viewing is the only use consistent with the findings. Anyone who has already interacted with it should treat any credentials or funds exposed there as potentially compromised and secure them promptly.