Is towolabs.info a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

towolabs.info is a recently registered .info website. The only content retrievable from its homepage was a security interstitial from its CDN provider, titled as a suspected-phishing warning, so no products, services, or business model could be observed. The site presents no verifiable commercial purpose, and its apparent function is unconfirmed.

Scam/Impersonation Risk

Contradictory signals are present and decisive. Several major endpoint-security vendors currently flag the domain as malicious, with further engines rating it suspicious. This confirms a blacklist hit rather than a soft reputational concern. The CDN provider's own interstitial labels the site as suspected phishing, which is consistent with that external verdict. The domain is very young. Its short archive footprint is a single capture, with no established history of benign operation. Browser-behaviour testing showed no wallet-connection prompts, clipboard manipulation, hidden forms, or credential posts to external hosts. It did show heavy outbound traffic and numerous scripting errors. That limited absence of active exploit behaviour does not offset the blacklist hit. No conflicting legal entities or brand impersonation were identified, so the risk rests on threat detections and not on identity contradictions. Credential entry, logins, and any financial interaction are unsafe. At most, passive read-only access is tolerable. Evidence:

• Homepage: the captured page was a CDN-issued interstitial titled as a suspected-phishing warning, and the request was blocked with a 403 response.
• Reputation: 17 security engines rated the domain malicious and 2 suspicious, including several tier-one vendors.
• Domain provenance: registered 2026-07-20 (~0.27 years old); the web archive holds 1 snapshot, captured 2026-07-23, with 1 year tracked.
• Behaviour: 94 external XHR requests and 9 external POSTs across 3 runs, 22 console errors, and no wallet, clipboard, or hidden-form activity.

Regulatory Verification Notes

No operator name, legal entity, licence, or registration number could be associated with the site. The retrievable content contains no legal, terms, or about material. The registration record also discloses no identifiable registrant, which constitutes ownership opacity and not an identity contradiction. Real-world identity therefore remains unverified, and no regulatory standing can be inferred. Nothing indicates third-party regulatory coverage. No broker-reputation dataset matched the domain. The absence of licensing information is a verification gap in its own right. The adverse conclusion rests on the threat detections, not on this gap. Evidence:

• Homepage: no company name, licence, or registration identifier appears in the content that was captured.
• Registration record: registered through NICENIC International Group Co., Limited, with no disclosed registrant, expiring 2027-07-20.
• Hosting: served from AS13335 (Cloudflare, Inc., US).
• Transport encryption: TLS certificate issued by WE1 (DV, domain-validated only), valid to 2026-12-17. A DV certificate confirms domain control, not operator identity.

What to Verify Next

Any visitor who reached this domain through a link, message, or advertisement should treat that source as suspect. They should open the claimed brand or service only through an address obtained independently, such as a known official channel, and confirm whether the brand actually operates this domain. If the site claims to offer regulated services, the licence claim should be checked against the relevant regulator's public register using an independently sourced entity name. The domain's reputation status should be re-checked after a reasonable interval, since listings can change. An owner who recognises the domain should audit the hosting account and site files for compromise or unauthorised changes. Evidence:

• Reputation: the current detections come from multiple independent security engines and the CDN interstitial. They justify treating the domain as hostile until re-assessment shows otherwise.
• Registration: the domain is only a few months old, so there is no long operating record to rely on.
• Homepage: no on-page contact, entity, or licence details were available to validate directly.

Summary Verdict

The available evidence places this website in a clearly high-risk posture. Multiple independent threat detections, a phishing-style warning from the CDN provider, and a very young domain with no verifiable operator identity converge on the same conclusion. Neither the valid transport encryption nor the absence of observed exploit behaviour materially changes that assessment. The site is not suitable for credential, login, or financial use.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and WAF, with a valid TLS certificate, and all observed addresses are edge servers. The origin server was not observable, so the hosting behind the edge cannot be independently assessed. This arrangement is a modest mitigating factor in terms of infrastructure hygiene. It is not evidence of legitimacy and cannot offset the external threat detections.

Closing Assessment

Do not enter credentials, make payments, download files, or connect any account on this domain. Anyone who already did so should change affected passwords and monitor the accounts concerned. Further engagement should wait until the threat listings clear and the operator's identity is confirmed through independent channels.