Is tomoguide.com safe?
http://tomoguide.com/
Coveragestrong5 of 6 applicable core capabilities
tomoguide.com is a 171-day-old download page that locks a "fan-made" Nintendo port behind sponsor offers and app installs, and multiple antivirus families flag the domain.
The site presents itself as a portal for a "fan-made mobile port" of a Nintendo game and asks visitors to "complete one sponser offer or apps install" before they can get the download. That is a content-locker funnel: the download is the bait, and the real product is the affiliate offer or app install the visitor is pushed into. Two independent antivirus families have reported an adverse result for the domain, and the page is served over plain HTTP with no redirect to HTTPS, so nothing typed or transferred on it is encrypted. The domain is only 171 days old, and no contact email was found on the captured page. The browser threat feed returned no warning, which is the one supportive technical signal, but it does not offset the offer-gated download flow and the vendor detections.
Be the first to review tomoguide.com
Lost money to tomoguide.com? Warn others
Did you use tomoguide.com?
Loading saved screenshot
Preparing the saved page preview.
Follow tomoguide.com
Get a notification in your MalwareTips bell when new reviews arrive (one digest a day at most), when the verdict changes after a rescan, and when MalwareTips or the verified site owner replies. Unfollow any time.
Where this site sits
- Dangerous1–20
- High Risk21–44
- Moderate Risk45–69
- Low Risk70–84
- Safe85–100
The score combines saved evidence strength and analysis quality. Coverage is reported separately.
01 · Investigation Brief
Investigation Brief
The site presents itself as a portal for a "fan-made mobile port" of a Nintendo game and asks visitors to "complete one sponser offer or apps install" before they can get the download. That is a content-locker funnel: the download is the bait, and the real product is the affiliate offer or app install the visitor is pushed into. Two independent antivirus families have reported an adverse result for the domain, and the page is served over plain HTTP with no redirect to HTTPS, so nothing typed or transferred on it is encrypted. The domain is only 171 days old, and no contact email was found on the captured page. The browser threat feed returned no warning, which is the one supportive technical signal, but it does not offset the offer-gated download flow and the vendor detections.
The download is gated behind sponsor offers and app installs
The page's own copy says: "To keep this project running at zero cost to you , we ask that you complete one sponser offer or apps install. It takes less than 3 minutes." A second block repeats the instruction as a call to action: "Install A Sponsor App Or Complete An Offer."
This is the classic content-locker pattern. The visitor is not buying anything and is not asked to pay; instead the price of the file is an affiliate conversion — an app install or an offer completion that pays the site operator. The download itself is the lure, and the visitor's device and attention are the product.
The file being offered is described on the page as "a fan-made mobile port" carrying Nintendo trademarks. That framing is what makes the offer-gated flow work: the visitor wants a game they cannot get officially, and the site converts that demand into sponsor installs.
Vendor detections, plain HTTP, and a young domain with no contact route
Two independent antivirus families reported an adverse result for this domain, naming BitDefender, Chong Lua Dao and G-Data. The saved observation is marked stale, so the detection is real but its timing should be confirmed; it is still the strongest adverse technical signal in the file.
The scanned address was served over plain HTTP with no redirect to HTTPS, even though a valid TLS certificate exists for the host. Anything a visitor submits on the page travels unencrypted, and the sponsor-offer flow is exactly the kind of page where a visitor may be asked to enter details.
The registrable domain is 171 days old, and no direct contact email was found on the captured page. A short-lived download portal with no visible contact route and an offer-gated file is a combination that gives a visitor no way to verify who is behind it or to seek recourse.
The browser threat feed returned no threat warning, which is a genuine supportive signal, but it only means no blocklist entry was present at scan time. It does not clear the offer-gated download flow or the vendor detections.
Why the score is 38
2 independent antivirus families reported an adverse result. This comes from a saved antivirus observation rather than a new submission, so treat the detection as real but confirm the timing. Coverage remains separate so missing sources cannot be mistaken for clean results.
02 · Security Evidence
Security evidence
Antivirus Engines
4/ 93
detectionsSaved analysis from October 5, 2026 - stale
4 engines flagged this URL
Every saved adverse engine is listed below. The full provider matrix remains available for audit.
- Malicious
- 3
- Suspicious
- 1
- Total
- 93
| Engine | Finding |
|---|---|
| BitDefenderMalicious | phishing |
| Chong Lua DaoMalicious | malicious |
| G-DataMalicious | phishing |
| alphaMountain.aiSuspicious | suspicious |
All 93 engine results
- BitDefender - phishing - Malicious
- Chong Lua Dao - Malicious
- G-Data - phishing - Malicious
- alphaMountain.ai - Suspicious
- 0xSI_f33d - Unrated
- Abusix - Clean
- Acronis - Clean
- ADMINUSLabs - Clean
- AILabs (MONITORAPP) - Clean
- AlienVault - Clean
- AlphaSOC - Unrated
- Antiy-AVL - Clean
- ArcSight Threat Intelligence - Unrated
- AutoShun - Unrated
- Bfore.Ai PreCrime - Unrated
- Bkav - Unrated
- BlockList - Clean
- Blueliv - Clean
- Certego - Clean
- ChainPatrol - Unrated
- CINS Army - Clean
- CRDF - Clean
- Criminal IP - Unrated
- CSIS Security Group - Unrated
- CTX AI - Clean
- Cyan - Unrated
- Cyble - Clean
- CyRadar - Clean
- desenmascara.me - Clean
- DNS8 - Unrated
- Dr.Web - Clean
- EmergingThreats - Clean
- Emsisoft - Clean
- Ermes - Unrated
- ESET - Clean
- ESTsecurity - Clean
- Forcepoint ThreatSeeker - Clean
- Fortinet - Clean
- Fortra - Unrated
- GCP Abuse Intelligence - Unrated
- Google Safe Browsing - Clean
- GreenSnow - Clean
- GreyNoise - Unrated
- Gridinsoft - Unrated
- Guardpot - Unrated
- Heimdal Security - Clean
- Hunt.io Intelligence - Unrated
- IPsum - Clean
- Juniper Networks - Clean
- K7AntiVirus - Unrated
- Kaspersky - Clean
- LevelBlue - Unrated
- Lionic - Clean
- Lumu - Unrated
- Malwared - Clean
- MalwarePatrol - Clean
- MalwareURL - Unrated
- Mimecast - Unrated
- Netcraft - Unrated
- OpenPhish - Clean
- Orcapot - Unrated
- PhishFort - Unrated
- Phishing Database - Clean
- Phishtank - Clean
- PREBYTES - Clean
- PrecisionSec - Unrated
- Quick Heal - Clean
- Quttera - Clean
- Rising - Clean
- SafeToOpen - Unrated
- Sangfor - Clean
- Sansec eComscan - Unrated
- Scantitan - Clean
- SCUMWARE.org - Clean
- Seclookup - Clean
- Snort IP sample list - Unrated
- SOCRadar - Unrated
- Sophos - Clean
- StopForumSpam - Clean
- Sucuri SiteCheck - Clean
- Synthient - Unrated
- ThreatHive - Clean
- URLhaus - Clean
- URLQuery - Unrated
- Viettel Threat Intelligence - Clean
- VIPRE - Unrated
- ViriBack - Clean
- VX Vault - Clean
- Webroot - Clean
- Xcitium Verdict Cloud - Clean
- Yandex Safebrowsing - Clean
- ZeroCERT - Clean
- ZeroFox - Unrated
Security Scans
Checked against the browser threat feeds available to this scan — no hit.
What we observed
Loading saved screenshot
Preparing the saved page preview.
Visual context from the captured page
Tomodachi Life: Living the Dream
What the captured page showed
1 observation- 01
Tomodachi Life: Living the Dream
03 · Investigation Story
Investigation story
What the site claims
Tomodachi Life: Living the Dream
What we observed
The page content was captured and checked alongside 58 antivirus results.
What independent research found
The search completed without a material external warning or corroborating report.
What remains unverified
1 of the 6 applicable core capabilities did not complete, so those gaps remain visible in the coverage ledger.
What kind of site and risk is this?
Threat category
Fake Shop & Commercial Deception
Service and business model
Downloader
Observed behavior
Evidence behind this classification
- 012 independent antivirus families reported an adverse result. This comes from a saved antivirus observation rather than a new submission, so treat the detection as real but confirm the timing.
- 02The registrable domain is 171 days old and no direct contact email was found on the captured page.
- 03The browser threat feed returned no threat warning at scan time.
If this is a scam — what it means for you
What happens when a visitor tries to get the file
A visitor who wants the advertised port clicks a download button and is told to "complete one sponser offer or apps install" first. The download does not start; the visitor is redirected into a sponsor flow instead.
If this is a scam, how it works
The evidence-backed path
Each stage below is preserved from the grounded analysis and linked to saved evidence.
The instruction is repeated as a standalone call to action — "Install A Sponsor App Or Complete An Offer" — so the visitor's next step is installing an app or completing an offer of unknown provenance, on a page served over unencrypted HTTP.
Because the domain is 171 days old and no contact email was found on the captured page, a visitor who installs the sponsor app or completes the offer has no visible operator to hold accountable if the installed software or the promised file turns out to be unwanted.
Do not complete the sponsor offers or install the promoted apps, and do not download the advertised port from this site. If you want the game, use official Nintendo channels. If you already installed a sponsor app, remove it and run a reputable security scan; if you entered any credentials on the page, change those passwords, since the connection was unencrypted.
Web research findings
Independent findings for tomoguide.com, including public complaints, named review sources, registration records, and look-alike-domain evidence. A missing result is shown as unverified, never converted into a clean bill of health.
No independently sourced scam reports or credibility records were found for tomoguide.com. That is common for new or low-traffic sites and does not clear the site.
Reputation Sources
How this domain rates across independent threat-intelligence and blocklist providers.
04 · Domain & Infrastructure
Domain & infrastructure
The plumbing behind the site — who registered it, how it’s encrypted, where it’s hosted, and where it links out. A valid certificate or a calm server doesn’t mean the business is honest — scam sites pass these checks too. Use this to corroborate the verdict, not to overturn it.
Infrastructure map
How the saved page connected to the wider web.
- Domaintomoguide.com
- Redirects totomoguide.com
- Hosted byWebhosting Holdings LLC
- Referencesfonts.googleapis.com · fonts.gstatic.com
Domain Timeline
- May 7, 2026Domain registered
First appeared in WHOIS records — 5 months old when this review was saved.
- Oct 26, 2026Saved security review — Rated High Risk
The completed checks from this saved scan are detailed above.
tomoguide.com was registered very recently when this review was saved and was already flagged. Freshly-registered domains are disproportionately used for scams, and a young domain with active threat signals warrants extra caution.
Contact Verification
Saved contact details can help identify the operator. Their presence supports traceability; it does not prove the business is trustworthy.
- No direct contact email found on the captured page.
Domain & Encryption
Server Reputation
Referenced Domains
Outbound domains this page links to or loads resources from. Each links to its own security scan.
05 · Evidence Ledger
Evidence ledger
- Antiviruspartial
- Browser threat feedcomplete
- Page contentcomplete
- Analysiscomplete
- Visual evidencecomplete
The conclusion is supported by the evidence saved with this report.
Technical threat
suspiciousMalware, phishing, credential theft and hostile infrastructure.
2 independent antivirus families reported an adverse result. This comes from a saved antivirus observation rather than a new submission, so treat the detection as real but confirm the timing.
Operator / customer risk
suspiciousComplaints, withdrawals, business conduct and commercial traps.
The page requires visitors to complete a sponsor offer or app install before the download is provided, an affiliate-driven content-locker flow. · The registrable domain is 171 days old and no direct contact email was found on the captured page.
Source coverage and freshness
Status shows whether usable evidence was saved; finding shows what that evidence observed.
| Source | Result | Completion | Finding | Freshness |
|---|---|---|---|---|
| Antivirus | 4 of 93 engines flagged | Limited | Adverse | stale fallback · analysed Oct 5, 2026 |
| Browser protection | No browser threat-list match | Completed | No adverse finding | this scan · Oct 26, 2026 |
| Page content | Page fetched · HTTP 200 | Completed | No adverse finding | this scan · Oct 26, 2026 |
| Visual evidence | 1 visible observation saved with the page capture | Completed | No adverse finding | this scan · Oct 26, 2026 |
| Independent research | The search completed without a material external finding | Completed | No adverse finding | this scan · Oct 26, 2026 |
- Antivirus
- Result4 of 93 engines flagged
- CompletionLimited
- FindingAdverse
- Freshnessstale fallback · analysed Oct 5, 2026
- Browser protection
- ResultNo browser threat-list match
- CompletionCompleted
- FindingNo adverse finding
- Freshnessthis scan · Oct 26, 2026
- Page content
- ResultPage fetched · HTTP 200
- CompletionCompleted
- FindingNo adverse finding
- Freshnessthis scan · Oct 26, 2026
- Visual evidence
- Result1 visible observation saved with the page capture
- CompletionCompleted
- FindingNo adverse finding
- Freshnessthis scan · Oct 26, 2026
- Independent research
- ResultThe search completed without a material external finding
- CompletionCompleted
- FindingNo adverse finding
- Freshnessthis scan · Oct 26, 2026
07 · Safety FAQ
Safety FAQ
Common questions, answered directly from the scan data above — so the answers reflect the saved verdict and evidence in this report.
Is it safe to download from tomoguide.com?
Is tomoguide.com safe to use?
Will I get a virus from tomoguide.com?
Why does tomoguide.com show several "Download" buttons?
Has tomoguide.com been flagged by antivirus engines?
Is tomoguide.com on any phishing or malware blacklists?
How old is the tomoguide.com domain?
Does tomoguide.com have a valid SSL certificate?
Where is tomoguide.com hosted?
How often is the tomoguide.com report updated?
08 · Final Verdict
Final verdict
tomoguide.com is a 171-day-old download page that locks a "fan-made" Nintendo port behind sponsor offers and app installs, and multiple antivirus families flag the domain.
The site presents itself as a portal for a "fan-made mobile port" of a Nintendo game and asks visitors to "complete one sponser offer or apps install" before they can get the download. That is a content-locker funnel: the download is the bait, and the real product is the affiliate offer or app install the visitor is pushed into. Two independent antivirus families have reported an adverse result for the domain, and the page is served over plain HTTP with no redirect to HTTPS, so nothing typed or transferred on it is encrypted. The domain is only 171 days old, and no contact email was found on the captured page. The browser threat feed returned no warning, which is the one supportive technical signal, but it does not offset the offer-gated download flow and the vendor detections.
09 · Community
Community
Are you the owner of tomoguide.com?Verify and reply