Is formaphone.layero.app safe?
http://formaphone.layero.app/
Coveragestrong3 of 4 applicable core capabilities
FormaPhone is a brand-new, launch-disabled storefront on a Russian deployment platform that multiple antivirus engines flag as phishing.
FormaPhone presents itself as a shop selling Apple hardware, with a cart and a 'Choose yours' call to action, but its own page states the store is preparing for launch and real payments are disabled. The registrable domain is only 89 days old, and nine independent antivirus families have reported an adverse result against it. The operator claims to be an individual entrepreneur with Russian tax identifiers, yet no direct contact email, phone number, or postal address is visible on the captured page. The browser threat feed and the TLS check are clean, but those only mean no active warning and a valid encrypted connection, not that the store is trustworthy. Because the site's own pages could not be fully reviewed and the antivirus flags are stale, the score sits in the High Risk band rather than Dangerous.
Be the first to review formaphone.layero.app
Lost money to formaphone.layero.app? Warn others
Loading saved screenshot
Preparing the saved page preview.
Where this site sits
- Dangerous1–20
- High Risk21–44
- Moderate Risk45–69
- Low Risk70–84
- Safe85–100
The score combines saved evidence strength and analysis quality. Coverage is reported separately.
01 · Investigation Brief
Investigation Brief
FormaPhone presents itself as a shop selling Apple hardware, with a cart and a 'Choose yours' call to action, but its own page states the store is preparing for launch and real payments are disabled. The registrable domain is only 89 days old, and nine independent antivirus families have reported an adverse result against it. The operator claims to be an individual entrepreneur with Russian tax identifiers, yet no direct contact email, phone number, or postal address is visible on the captured page. The browser threat feed and the TLS check are clean, but those only mean no active warning and a valid encrypted connection, not that the store is trustworthy. Because the site's own pages could not be fully reviewed and the antivirus flags are stale, the score sits in the High Risk band rather than Dangerous.
Clean technical checks do not clear the operator
The browser threat feed returned no threat warning and the saved TLS check found a valid encrypted connection. Those are baseline hygiene signals, not proof of legitimacy. They mean the connection is encrypted and Google has not currently listed the domain, not that the store is safe to buy from.
Against that, nine independent antivirus families reported an adverse result, naming alphaMountain.ai, BitDefender, and Emsisoft among them. That detection is real but comes from a saved observation rather than a fresh submission, so its timing is uncertain. A brand-new domain with multiple phishing flags is a serious warning sign even when the site currently says payments are disabled.
The operator identity is disclosed as 'ИП Оглы Маршал Андреевич' with INN 235214376942 and OGRNIP 325237500126934, but the captured page shows no direct contact email, no phone number, and no postal address. Printing an entity and tax ID is not by itself a favourable signal, and the absence of reachable contact details makes it hard for a buyer to resolve any problem.
A shop front that is not yet taking real payments
The site shows a 'Корзина 0' (Cart 0) checkout link and a 'Выбрать своё' (Choose yours) call to action, and it lists 'Условия продажи' (Terms of sale). Those are the normal commercial controls of an online store, and they are the only commercial paths observed on the page.
However, the same page states 'Магазин готовится к запуску. Реальные платежи отключены.' (The store is preparing for launch. Real payments are disabled). So the checkout is not currently functional for real money, and the cart is empty. A visitor cannot complete a purchase today, which limits immediate exposure but also means the store's real fulfilment behaviour is untested.
The domain is hosted on layero.app, a Russian deployment platform for frontend applications. That hosting choice is neutral by itself, but combined with an 89-day-old domain and no independent reputation evidence, it does not establish that the shop is a going concern.
Why the score is 38
9 independent antivirus families reported an adverse result. This comes from a saved antivirus observation rather than a new submission, so treat the detection as real but confirm the timing. Coverage remains separate so missing sources cannot be mistaken for clean results.
02 · Security Evidence
Security evidence
Antivirus Engines
12/ 93
detectionsSaved analysis from October 16, 2026 - stale
12 engines flagged this URL
Every saved adverse engine is listed below. The full provider matrix remains available for audit.
- Malicious
- 11
- Suspicious
- 1
- Total
- 93
| Engine | Finding |
|---|---|
| alphaMountain.aiMalicious | phishing |
| BitDefenderMalicious | phishing |
| EmsisoftMalicious | phishing |
| FortinetMalicious | phishing |
| G-DataMalicious | phishing |
| LionicMalicious | phishing |
| NetcraftMalicious | malicious |
| RisingMalicious | phishing |
| SophosMalicious | phishing |
| VIPREMalicious | phishing |
| WebrootMalicious | malicious |
| ESETSuspicious | suspicious |
All 93 engine results
- alphaMountain.ai - phishing - Malicious
- BitDefender - phishing - Malicious
- Emsisoft - phishing - Malicious
- Fortinet - phishing - Malicious
- G-Data - phishing - Malicious
- Lionic - phishing - Malicious
- Netcraft - Malicious
- Rising - phishing - Malicious
- Sophos - phishing - Malicious
- VIPRE - phishing - Malicious
- Webroot - Malicious
- ESET - Suspicious
- 0xSI_f33d - Unrated
- Abusix - Clean
- Acronis - Clean
- ADMINUSLabs - Clean
- AILabs (MONITORAPP) - Clean
- AlienVault - Clean
- AlphaSOC - Unrated
- Antiy-AVL - Clean
- ArcSight Threat Intelligence - Unrated
- AutoShun - Unrated
- Bfore.Ai PreCrime - Unrated
- Bkav - Unrated
- BlockList - Clean
- Blueliv - Clean
- Certego - Clean
- ChainPatrol - Unrated
- Chong Lua Dao - Clean
- CINS Army - Clean
- CRDF - Clean
- Criminal IP - Clean
- CSIS Security Group - Unrated
- CTX AI - Clean
- Cyan - Unrated
- Cyble - Clean
- CyRadar - Clean
- desenmascara.me - Clean
- DNS8 - Unrated
- Dr.Web - Clean
- EmergingThreats - Clean
- Ermes - Unrated
- ESTsecurity - Clean
- Forcepoint ThreatSeeker - Unrated
- Fortra - Unrated
- GCP Abuse Intelligence - Unrated
- Google Safe Browsing - Clean
- GreenSnow - Clean
- GreyNoise - Unrated
- Gridinsoft - Unrated
- Guardpot - Unrated
- Heimdal Security - Clean
- Hunt.io Intelligence - Unrated
- IPsum - Clean
- Juniper Networks - Clean
- K7AntiVirus - Unrated
- Kaspersky - Clean
- LevelBlue - Clean
- Lumu - Unrated
- Malwared - Clean
- MalwarePatrol - Clean
- MalwareURL - Unrated
- Mimecast - Unrated
- OpenPhish - Clean
- Orcapot - Unrated
- PhishFort - Unrated
- Phishing Database - Clean
- Phishtank - Clean
- PREBYTES - Clean
- PrecisionSec - Unrated
- Quick Heal - Clean
- Quttera - Clean
- SafeToOpen - Unrated
- Sangfor - Clean
- Sansec eComscan - Unrated
- Scantitan - Clean
- SCUMWARE.org - Clean
- Seclookup - Clean
- Snort IP sample list - Unrated
- SOCRadar - Unrated
- StopForumSpam - Clean
- Sucuri SiteCheck - Clean
- Synthient - Unrated
- ThreatHive - Clean
- URLhaus - Clean
- URLQuery - Unrated
- Viettel Threat Intelligence - Clean
- ViriBack - Clean
- VX Vault - Clean
- Xcitium Verdict Cloud - Clean
- Yandex Safebrowsing - Clean
- ZeroCERT - Clean
- ZeroFox - Unrated
Security Scans
Checked against the browser threat feeds available to this scan — no hit.
What we observed
Loading saved screenshot
Preparing the saved page preview.
Visual context from the captured page
FormaPhone iPhone 18 Pro 115 400 ₽
What the captured page showed
2 observations- 01
FormaPhone
- 02
iPhone 18 Pro 115 400 ₽
03 · Investigation Story
Investigation story
What the site claims
FormaPhone — техника Apple
What we observed
The page content was captured and checked alongside 61 antivirus results.
What independent research found
2 external findings were saved and compared with the page evidence.
What remains unverified
1 of the 4 applicable core capabilities did not complete, so those gaps remain visible in the coverage ledger.
What kind of site and risk is this?
Threat category
Fake Shop & Commercial Deception
Service and business model
Shop
Observed behavior
Evidence behind this classification
- 019 independent antivirus families reported an adverse result. This comes from a saved antivirus observation rather than a new submission, so treat the detection as real but confirm the timing.
- 02The registrable domain is only 89 days old, which is too new to have an established reputation.
- 03The site states the store is preparing for launch and real payments are disabled, so no real transaction can currently be completed.
Web research findings
Independent findings for formaphone.layero.app, including public complaints, named review sources, registration records, and look-alike-domain evidence. A missing result is shown as unverified, never converted into a clean bill of health.
No independently sourced scam reports or credibility records were found for formaphone.layero.app. That is common for new or low-traffic sites and does not clear the site.
Reputation Sources
How this domain rates across independent threat-intelligence and blocklist providers.
04 · Domain & Infrastructure
Domain & infrastructure
The plumbing behind the site — who registered it, how it’s encrypted, where it’s hosted, and where it links out. A valid certificate or a calm server doesn’t mean the business is honest — scam sites pass these checks too. Use this to corroborate the verdict, not to overturn it.
Infrastructure map
How the saved page connected to the wider web.
- Domainformaphone.layero.app
- Redirects toformaphone.layero.app
- Hosted byYandex.Cloud LLC
- Referencesmc.yandex.ru
Domain Timeline
- Jul 21, 2026Domain registered
First appeared in WHOIS records — 89 days old when this review was saved.
- Oct 19, 2026Saved security review — Rated High Risk
The completed checks from this saved scan are detailed above.
formaphone.layero.app was registered very recently when this review was saved and was already flagged. Freshly-registered domains are disproportionately used for scams, and a young domain with active threat signals warrants extra caution.
Contact Verification
Saved contact details can help identify the operator. Their presence supports traceability; it does not prove the business is trustworthy.
- No direct contact email found on the captured page.
- No phone number listed on the captured page.
- No operator postal address visible on the captured page.
Domain & Encryption
Redirect Chain
- 1301http://formaphone.layero.app/
- 2206https://formaphone.layero.app/
Server Reputation
Referenced Domains
Outbound domains this page links to or loads resources from. Each links to its own security scan.
05 · Evidence Ledger
Evidence ledger
- Antiviruspartial
- Browser threat feedcomplete
- Page contentcomplete
- Analysiscomplete
- Visual evidencecomplete
The conclusion is supported by the evidence saved with this report.
Technical threat
suspiciousMalware, phishing, credential theft and hostile infrastructure.
9 independent antivirus families reported an adverse result. This comes from a saved antivirus observation rather than a new submission, so treat the detection as real but confirm the timing.
Operator / customer risk
suspiciousComplaints, withdrawals, business conduct and commercial traps.
The site states the store is preparing for launch and real payments are disabled, so no real transaction can currently be completed. · The registrable domain is only 89 days old, which is too new to have an established reputation.
Source coverage and freshness
Status shows whether usable evidence was saved; finding shows what that evidence observed.
| Source | Result | Completion | Finding | Freshness |
|---|---|---|---|---|
| Antivirus | 12 of 93 engines flagged | Limited | Adverse | stale fallback · analysed Oct 16, 2026 |
| Browser protection | No browser threat-list match | Completed | No adverse finding | this scan · Oct 19, 2026 |
| Page content | Page fetched · HTTP 200 | Completed | No adverse finding | this scan · Oct 19, 2026 |
| Visual evidence | 2 visible observations saved with the page capture | Completed | No adverse finding | this scan · Oct 19, 2026 |
| Independent research | 2 independent findings were saved | Completed | No adverse finding | this scan · Oct 19, 2026 |
- Antivirus
- Result12 of 93 engines flagged
- CompletionLimited
- FindingAdverse
- Freshnessstale fallback · analysed Oct 16, 2026
- Browser protection
- ResultNo browser threat-list match
- CompletionCompleted
- FindingNo adverse finding
- Freshnessthis scan · Oct 19, 2026
- Page content
- ResultPage fetched · HTTP 200
- CompletionCompleted
- FindingNo adverse finding
- Freshnessthis scan · Oct 19, 2026
- Visual evidence
- Result2 visible observations saved with the page capture
- CompletionCompleted
- FindingNo adverse finding
- Freshnessthis scan · Oct 19, 2026
- Independent research
- Result2 independent findings were saved
- CompletionCompleted
- FindingNo adverse finding
- Freshnessthis scan · Oct 19, 2026
07 · Safety FAQ
Safety FAQ
Common questions, answered directly from the scan data above — so the answers reflect the saved verdict and evidence in this report.
Is formaphone.layero.app a scam or a legit online store?
Is formaphone.layero.app safe to use?
What should I do if I already gave my details to formaphone.layero.app?
Can I get my money back from formaphone.layero.app?
I ordered from formaphone.layero.app but nothing arrived — is it a fake shop?
How do I report formaphone.layero.app?
Why does formaphone.layero.app look legitimate if it's a scam?
Has formaphone.layero.app been flagged by antivirus engines?
Is formaphone.layero.app on any phishing or malware blacklists?
How old is the formaphone.layero.app domain?
Does formaphone.layero.app have a valid SSL certificate?
How often is the formaphone.layero.app report updated?
08 · Final Verdict
Final verdict
FormaPhone is a brand-new, launch-disabled storefront on a Russian deployment platform that multiple antivirus engines flag as phishing.
FormaPhone presents itself as a shop selling Apple hardware, with a cart and a 'Choose yours' call to action, but its own page states the store is preparing for launch and real payments are disabled. The registrable domain is only 89 days old, and nine independent antivirus families have reported an adverse result against it. The operator claims to be an individual entrepreneur with Russian tax identifiers, yet no direct contact email, phone number, or postal address is visible on the captured page. The browser threat feed and the TLS check are clean, but those only mean no active warning and a valid encrypted connection, not that the store is trustworthy. Because the site's own pages could not be fully reviewed and the antivirus flags are stale, the score sits in the High Risk band rather than Dangerous.
09 · Community