Highscore 42 · flagged Monday, August 31, 2026

sharifcrypto.org

Appeared in the .org zone on Monday, August 31, 2026; by the end of that day the census found active website about crypto web3. Full domain report

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

What matched

page impersonates a brand
matched: Binance
+22
brand in page title, not in the name
matched: telegram
+20
Registrar
Name.com, Inc.
Nameserver provider
Nameservers
dns1.p01.nsone.net, dns2.p01.nsone.net, dns3.p01.nsone.net, dns4.p01.nsone.net
First-day state
active website
HTTP status
200
Page title
Sharif Crypto Community — Join on Telegram
Has a form
no
Brand echoed

Model opinions

Second opinionsuspiciousconfidence 55%· claude-opus-5

Self-branded 'Sharif Crypto Community' funnel page pushing visitors into Telegram/WhatsApp channels for leveraged crypto/forex/gold signals; Binance is only referenced as the exchange for an illustrative BTC/USDT setup, so there is no impersonation and no credential or payment form — but the Telegram/WhatsApp operator-waiting shape and 10x-leverage signal lure aimed at Pakistan/Afghanistan is the classic front-end of signal-group/broker-referral fraud.

First passlooks like a scamconfidence 85%· claude-haiku-4-5

The page uses Binance branding and screenshots to lend credibility to unverified trading signals, but does not impersonate Binance itself—it is a separate 'Sharif Crypto Community' service offering forex/crypto signals via Telegram/WhatsApp. This is a classic pump-and-dump or signal-seller scam: the operator collects followers via messaging apps (with contact info in Telegram) to monetize unregulated trading advice, not credential phishing. The domain and page are in the scammer's own name, not

A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.

What the page looked like on Monday, August 31, 2026

Screenshot of sharifcrypto.org taken by the zone census on 2026-08-31

Same data as JSON: /api/zone/domain/sharifcrypto.org. This page is not indexed by search engines and does not link to the site it describes.