formaphone.layero.app
Category: Phishing
- Don't sign in or pay here. Close it. If you typed a password, change it where you normally use it.
- Already visited? Check your device. A free scan shows whether anything was installed.
- Stop the next one. Combo Cleaner's web protection blocks phishing and scam sites before they load.
Combo Cleaner is PCrisk's own anti-malware tool, owned by RCS LT. Free to scan; removing what it finds needs a licence (7-day free trial).
Description of formaphone.layero.app
FormaPhone appears to be a Russian-language online storefront focused on Apple-related consumer electronics. The page title and metadata describe it as a place to browse products such as iPhone, Mac, iPad, Apple Watch, and AirPods, and the visible navigation includes catalog, delivery/payment, warranty/returns, contacts, cart, and offer pages.
Based on the domain structure, the site is hosted as a subdomain under layero.app rather than on a standalone branded domain. The homepage presentation resembles a modern electronics shop and appears aimed at consumers looking for Apple devices and accessories, but the operator identity is not clearly established from the provided scan data alone.
Safety Assessment for formaphone.layero.app
Multiple security engines flagged this domain for phishing or other malicious behavior at the time of this scan, which is a significant warning sign. In addition, the domain is very new, has no established traffic ranking in the provided data, and closely aligns itself with Apple-branded products despite operating from an unrelated subdomain rather than an obvious official retailer domain. Those factors can be consistent with look-alike retail or credential/payment-harvesting activity.
The malware scan did not detect malicious files in the sampled page resources, and major content-focused blacklist checks in the provided data did not report active malware hosting at the time of this scan. However, the domain's IP address is listed on one mail-reputation blocklist, which is a weaker but still cautionary signal. Taken together, the phishing detections from multiple security engines outweigh the clean file scan here.
Based on these findings, this website may pose potential risks to visitors.
Technical Description
The site uses a valid Let's Encrypt SSL certificate and is served over nginx from an IP hosted by Yandex.Cloud in Moscow, Russia. Nameservers also point to Yandex Cloud infrastructure. TLS is present, which helps encrypt connections, but certificate validity alone does not establish trustworthiness.
The domain is only 89 days old, DNSSEC is unsigned, and it operates as a subdomain rather than a long-established standalone retail domain. No malicious files were flagged in the sampled resources, but the combination of recent registration, phishing detections by multiple security engines, and a mail-reputation blocklist listing suggests elevated technical risk indicators at the time of this scan.
Share your experience with this website. Was it safe? Did you encounter any issues?