Is tomanpay.co legit? TrustSniffer's high-trust assessment: 90/100

Overview

The website is a Persian-language business payment and settlement platform presenting Toman’s instant transfers, managed settlement, secure-transaction services, payment tools, financial dashboards, and APIs for merchants and other business customers.

Scam/Impersonation Risk

No identity contradictions, impersonation indicators, phishing behavior, or confirmed malicious reputation findings were observed. The operating identity presented on the homepage is coherent with the site’s payment-focused content, while the domain’s continuous archive record shows no suspicious repurposing or material change of business category. The observed page contained neither hidden forms nor credential-collection forms, and interactive testing detected no cloaking, clipboard manipulation, wallet-draining behavior, or suspicious inline scripts.

• The domain record shows registration through Web Commerce Communications Limited dba WebNic.cc on 3 July 2024, making the domain approximately 2.08 years old.
• The web archive contains 46 snapshots spanning 15 July 2024 to 24 May 2025, covering 2 tracked years with no semantic drift or suspicious repurposing.
• External threat checks recorded 0 malicious and 0 suspicious detections, with no phishing, brand-impersonation, or confirmed malicious-list finding.
• The homepage presented no login form, hidden form, sensitive form, or form posting credentials to an external destination.

Regulatory Verification Notes

The homepage provides a legal company identity, support details, links to terms and technical documentation, and references to trust symbols. It markets instant and ACH-style settlement through a dashboard or API, secure transaction handling, Toman Pay, cash-flow management, intelligent fraud detection, dedicated IP services, and automated reconciliation. It also publishes operational claims including 24/7 support, 98.5% user and business-partner satisfaction, a 99.6% transaction success rate, and a maximum reconciliation discrepancy of 0.0001%; these claims were not independently substantiated by the supplied evidence. The on-page licensing position is unclear because no licensing authority or licence number was identified. That is a disclosure-verification matter, not evidence of impersonation or fraud, and the absence of a match in the supplied broker dataset does not determine the company’s legal status.

• The homepage identifies the operating company and links visitors to terms, technical documentation, and trust-symbol material.
• The homepage describes business payment, settlement, transaction-security, dashboard, and API services alongside the stated performance metrics.
• The site is served from AS205585 by ARVANCLOUD-CDN-IR — Noyan Abr Arvan Co. (Private Joint Stock), Iran.
• The site’s transport encryption uses a DV TLS certificate issued by YE1, valid until 25 October 2026.

What to Verify Next

Institutional onboarding should confirm the legal entity against the applicable corporate registry and establish whether each offered payment or settlement activity requires authorization in the relevant operating jurisdiction. The cited trust symbols should be checked directly with their issuing bodies, and the published commercial service levels should be incorporated into contractual due diligence where operational reliance is material. Official support and sales channels should also be confirmed through an independent corporate route before establishing a business integration.

• The homepage includes terms and trust-symbol references that provide specific starting points for documentary verification.
• Technical-documentation links are presented for the platform’s integration services and can support API security and operational-resilience review.
• The homepage publishes telephone, support, and sales contact routes suitable for independent channel confirmation.
• No third-party regulatory match was supplied, so authorization status must be established from the relevant official registry rather than inferred from reputational data.

Summary Verdict

The website presents as a legitimate, established, and trustworthy financial-services platform. Its consistent corporate presentation, continuous provenance, clean threat reputation, substantive service documentation, and sound technical controls converge on a high-confidence assessment with no contradictory risk signals. Normal interaction, including account login and standard use, is appropriate.

Infrastructure Integrity

The site resolves to two likely origin addresses rather than operating behind a detected CDN or WAF edge layer. Its infrastructure is directly attributable to ArvanCloud’s identified Iranian hosting network, and valid encrypted transport mitigates session-level exposure; these controls support technical integrity but are not, independently, proof of corporate legitimacy.

Closing Assessment

Prospective users may proceed with normal account and transaction activity, while institutional counterparties should complete their standard legal, contractual, and integration due diligence before production onboarding.