Is wallet-matrica.business a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website operates under the name wallet-matrica on a recently created ".business" domain, and its name suggests a cryptocurrency wallet or digital-asset service. The only page the analysis could reach was a Cloudflare access-restriction interstitial titled as an edge-IP restriction, and it carried no product or service content. The site's actual offering and business model could therefore not be established from its own content. The name alone points to a wallet or asset-custody context, which is the category where credential and key capture is most damaging.

Scam/Impersonation Risk

Contradictory signals are present, and they are the decisive factor in this assessment. The domain is confirmed blacklisted by several independent threat-intelligence engines, including a tier-one security vendor. Several of the engines classify it as malicious and others as suspicious, which is well beyond an isolated or low-confidence flag. No brand impersonation and no conflicting legal identities were observed. The risk therefore rests on the external blacklisting and not on identity contradictions. The domain's extreme youth sharpens that concern. A wallet-themed name on a domain only weeks old, already flagged by multiple engines, matches the profile of short-lived infrastructure built to harvest wallet credentials, seed phrases, or signing approvals. Behavioural testing did not capture a wallet-drainer routine, clipboard hijacking, hidden forms, or externally posted password fields. That absence is limited in value, because the access gate may have prevented the sandbox from reaching any interactive wallet flow. Roughly 120 external background requests and 5 external POST submissions were recorded, with the overwhelming majority of traffic going to third-party destinations. None of the destinations were non-whitelisted, and eight console errors were logged. Evidence:

• Homepage and domain reputation: the domain is listed as malicious or suspicious by multiple threat-intelligence engines, including a tier-one vendor.
• Domain registration: created 2026-08-28 (about 0.16 years old, roughly 58 days), through registrar NICENIC International Group Co., Limited.
• Homepage behavioural testing: 120 external XHR/fetch requests and 5 external POSTs across 3 runs, with about 98% of observed activity directed to external hosts. No non-whitelisted destinations, wallet-drainer activity, or clipboard writes were detected.
• Homepage capture: the page was served behind a Cloudflare bot challenge (HTTP 403) with an "Edge IP Restricted" title, so content-level fraud indicators could not be assessed.

Regulatory Verification Notes

No licensing, registration, or legal-entity information was available for assessment. The content reviewed contained no legal, terms, or about pages, and the on-page disclosure position is unclear. No third-party broker or regulatory profile matched the domain, and nothing connects it to a regulated entity. These are verification gaps and not proof of wrongdoing. They matter more here because the site's name implies handling of user assets, which in most jurisdictions would call for a registered or licensed operator. The site's transport encryption is valid, but the certificate is a basic domain-validated one. It confirms an encrypted connection and nothing about who operates the site. Evidence:

• Site hosting: served from AS13335 (Cloudflare, Inc., US).
• Transport encryption: TLS certificate issued by WE1 (DV level), valid to 2026-11-26 and close to renewal or expiry.
• Legal and identity pages: none retrievable in the captured content, so no operator, jurisdiction, or licence reference could be read.
• Third-party broker intelligence: no match for this domain.

What to Verify Next

The blacklisting should be treated as a reason to avoid engagement, not as a prompt for in-depth due diligence on the operator. If a counterparty directed a person to this site, the instruction should be confirmed through a channel established independently of the site, such as a known phone number or a previously verified official domain. Any claim that this is a branded wallet should be checked against that brand's officially published domains. If the site presents itself as a financial or custody service, its licence should be looked up directly in the relevant regulator's public register. Official support and contact channels should also be confirmed independently. The domain's listing status should be re-checked later, since a listing on a compromised site can be cleared, whereas one on a purpose-built site generally persists. Evidence:

• Domain age: the domain is under three months old, so no operating track record exists to lean on.
• Domain reputation: multiple engines currently list it, so any earlier reassurance from a third party should be re-validated.
• Homepage: no operator or licence reference was available to cross-check against a registry.

Summary Verdict

The assessment is critical, with an elevated risk posture. Confirmed external blacklisting combined with a very recently created domain outweighs the technical hygiene signals, which are limited to a valid certificate and clean-looking behavioural tests. Available evidence does not support treating this as a legitimate service, and the operator's identity remains unestablished.

Infrastructure Integrity

The site is fronted by Cloudflare's CDN and WAF, and every observed address is a Cloudflare edge address, so the underlying origin host could not be observed. This protection is a mitigating factor only. It shows the operator has basic hosting hygiene, but it does not indicate legitimacy and does not offset the external reputation findings. Edge-only visibility also prevents independent verification of where the content is hosted.

Closing Assessment

Account logins, credential entry, wallet connections, transaction signing, and any deposit of funds should be avoided entirely. Any contact should be limited to passive viewing in an isolated environment. Anyone who has already entered credentials or approved a wallet connection on this site should change the affected passwords immediately, revoke token approvals, and move assets to a freshly created wallet.