Critical risk detected
Flagged on major browser safety blocklists as social engineering. Our security review flagged this site as high-risk. Don't enter personal information, deposit money, or download files.
Is toapayoh.org legit or a scam?
Yes — this is almost certainly a scam.
HDB resale listing on a 1.2-year-old domain with an expired self-signed certificate and a browser social-engineering flag.
Score breakdown
These checks passed — but they don't clear the site. A clean antivirus result, valid SSL, and a calm server only mean it isn't hosting malware; they say nothing about whether the business is real. This verdict is based on the site's conduct and content, not a malware detection.
At a glance
The most useful evidence from this scan, separated from the final verdict so you can judge the signals yourself.
8 checks completedWebsite Preview
Automated page render — captured in a safe sandbox. What an ordinary visitor would see when loading the site. Marker positions are approximate. See full visual analysis →
Visual analysis
Intelligence
The page presents itself as a legitimate property listing for a real Toa Payoh address with plausible unit details and nearby MRT references. The strongest negative signal is the browser blocklist hit for social engineering combined with an invalid self-signed SSL certificate that expired months ago. The domain itself is only 1.2 years old, registered through a privacy-optional registrar, and the single listed phone number routes to a free email address rather than one on the site domain. No scam reports or business registration records appear in the evidence package, yet the combination of technical red flags and missing contact transparency keeps the risk elevated. The hosting IP carries a moderate abuse score with six prior reports, adding another layer of caution.
Web Research Findings
Domain Timeline
Threat Detection
Security Scans
Detected threat categories: SOCIAL_ENGINEERING.
Reputation Sources
How this domain rates across independent threat-intelligence and blocklist providers.
Technical Details
domain · encryption · redirects · server reputation · referencedThe plumbing behind the site — who registered it, how it’s encrypted, where it’s hosted, and where it links out. A valid certificate or a calm server doesn’t mean the business is honest — scam sites pass these checks too. Use this to corroborate the verdict, not to overturn it.
Contact Verification
We fetched the page and looked for real-world contact details. Legitimate businesses almost always publish an email on their own domain, a phone number, and a postal address. Scam shops usually don't.
- No email uses the site's own domain — legitimate shops usually do.
- No postal address visible on the page.
- Phone number listed (9382 6626).
Domain & Encryption
Server Reputation
Referenced Domains
Outbound domains this page links to or loads resources from. Each links to its own security scan.
User reviews & comments(0)
Share your experience — "Lost $200 on a fake checkout" is more useful than "Scam". Your review helps others avoid traps.