Is web3evmpayconnect.com a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a near-empty single landing page. Its only visible elements are a "Wallet connect" control and a generic button labelled in Russian "Нажми меня" ("Press me"). It has no title, description, company name, product, pricing or policy text. Its apparent purpose is to funnel visitors into connecting a cryptocurrency wallet, and no legitimate service, brand or business model is presented to justify that.

Scam/Impersonation Risk

Confirmed contradictory signals are present, and the posture is clearly cautionary. Several tier-one security vendors currently flag the domain as malicious, and a wider set of external detections corroborates them. This amounts to a confirmed blacklisting. It is decisive and outweighs any protective infrastructure or technical hygiene. The domain was registered only weeks ago, and the web archive holds just two captures, taken within days of registration. The site therefore has no operating history that could offset the reputational findings. The homepage offers a wallet-connection entry point with no stated service, token, protocol or counterparty. Connecting a wallet to an unexplained page is the standard entry step of wallet-draining and fake-payment schemes. The domain name itself ("web3 EVM pay connect") reads as a generic payment-connector lure rather than an identifiable brand. Automated sandbox runs recorded no outbound data exchange, no hidden forms and no wallet-draining behaviour. That result is limited, because the wallet control was never exercised. It does not show that the control is safe, and a malicious payload could sit behind that interaction. No brand impersonation or conflicting legal identities were detected, since the site names no entity at all. Evidence:

• Homepage: the only functional content is the wallet-connect control and a purposeless "Press me" button, about two dozen characters of visible text in total.
• Domain registration: created 2026-09-27 (~0.07 years, about 24 days old) through the registrar NICENIC International Group Co., Limited.
• Web archive: 2 snapshots in total, spanning 2026-09-27 to 2026-09-29, with no earlier history.
• External reputation: multiple major security vendors rate the domain malicious or suspicious, and it is blacklisted.

Regulatory Verification Notes

The site has no legal, terms, privacy, about or contact pages. It names no operating company, jurisdiction, licence or registration number. It does not say whether it intends to handle payments, custody or exchange services, any of which would normally require authorisation. Ownership is opaque, with no accountable entity attached to the site. No third-party broker or regulatory-database record matches the domain, so there is no independent reputational or licensing context to weigh. In this case the disclosure gap compounds the confirmed threat findings and is not a standalone concern. A site that invites wallet interaction while disclosing nothing about who is accountable cannot be assessed as a regulated or supervised operation. Evidence:

• Homepage: no company name, address, licence, registration number or policy text is published.
• Site structure: no internal pages or links were observed, so no legal or identity pages exist to review.
• Hosting and encryption: the site is served from AS202412 (Omegatech LTD), with a domain-validated TLS certificate issued by YR1, valid to 2026-12-26. Encryption confirms only a secure transport channel, not operator legitimacy.

What to Verify Next

Wallet connection, credentials and payments should be treated as off-limits until the blacklisting is resolved and an accountable operator is independently established. If the domain reached a user through a message, advertisement, social post or QR code, the sender or campaign should be authenticated through an independent channel. Anyone who has already connected a wallet or approved a transaction should review and revoke token approvals using a trusted block-explorer approval checker. They should also consider moving remaining assets to a fresh wallet. Any claim that the domain belongs to a payment or Web3 service should be checked against that provider's official, separately sourced website and support channels. Security teams should check whether the domain is a lookalike of a brand they use, and report it to their registrar and abuse desk if it is. Evidence:

• Homepage: the wallet-connect control is the only interactive element, and its destination and purpose are not described anywhere on the site.
• Registration profile: the domain is weeks old with no verifiable operator, so any claimed association must be confirmed independently.
• Reputation: the current malicious ratings should be re-checked before any reassessment.

Summary Verdict

The site carries an elevated, high-risk posture. Active adverse reputation findings combine with a brand-new, contentless page whose sole function is a wallet-connection prompt. No offsetting signal of legitimacy, history or accountable ownership exists. The evidence points to a throwaway or lure-style asset rather than a genuine service.

Infrastructure Integrity

The site sits behind a Cloudflare CDN/WAF, and the only observed address is a CDN edge address. The origin server is therefore not directly observable. This is a mitigating factor only, and it cannot offset the reputation findings. Edge-only visibility also limits independent hosting verification and would allow content to be swapped quickly without any visible change in infrastructure. The certificate is valid and issued by a known authority, which indicates basic technical hygiene but not trustworthiness.

Closing Assessment

Read-only observation from an isolated environment is the most that is advisable. The site should not be used for wallet connection, login, credential entry or any financial interaction, and no wallet should be linked to it.