Is claim-memdexone.com a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

Claim-memdexone.com is a recently registered website whose homepage is titled "MemDex — The Automated Portfolio". It presents itself as an automated portfolio product and carries a large amount of page content, including interactive elements and several password-entry forms. The hostname pairs the product name with a "claim" prefix. The apparent purpose is to draw visitors into an account or claim-style flow around an automated investment offering.

Scam/Impersonation Risk

This site presents elevated, corroborated risk. Multiple independent reputation sources currently flag the domain as malicious, including several major security vendors, and it is blacklisted by external threat-intelligence sources. This is the decisive finding, and the site's technical hygiene cannot offset it. The domain was registered only a few months ago. It pairs a product name with a "claim" prefix, a pattern commonly used for promotional or reward-style landing pages. This is an observation about naming, not proof of intent. No conflicting legal identities were observed, and no explicit brand impersonation was confirmed. The risk rests on the reputation listings and on the page's runtime behavior. During interaction testing, the homepage made many requests to external, non-allow-listed destinations, including outbound data submissions. It also rewrote large portions of its page after interaction and produced a very high volume of script errors. Three password-entry forms were present, so any credential typed into this page falls within the exposure described above. Evidence:

• Homepage: external reputation sources flag the domain as malicious, and it is listed on an external blacklist.
• Homepage: 19 external XHR/fetch calls and 4 external POST submissions to non-whitelisted destinations were observed across 3 sandbox runs.
• Homepage: 3 password forms were detected, with 3,789 DOM mutations after interaction and 112 console errors.
• Domain registration: created 2026-08-04 (~0.23 years old, about 84 days).

Regulatory Verification Notes

The captured homepage did not allow its legal, licensing, or operator-identity disclosures to be independently confirmed, so the on-page disclosure position remains unclear. The site's operator cannot be connected to a real-world company or person, and registration records do not identify an accountable owner. The site presents an investment-style "automated portfolio" proposition. A product of that kind would ordinarily be expected to disclose a regulated operator and a registry-checkable license. No such disclosure could be confirmed. No third-party broker-rating match exists for this site. That absence is neutral and is not a clearance. The transport-layer posture is routine and does not lend the site credibility. Encryption is valid but is a basic domain-validated certificate, which proves control of the domain and says nothing about who operates it. Evidence:

• Registrar of record: NICENIC INTERNATIONAL GROUP CO., LIMITED; registration runs to 2027-08-04, a one-year term.
• TLS certificate issued by WE1 (DV), valid to 2026-12-31 (64 days remaining).
• Served from AS13335 (Cloudflare, Inc., US).

What to Verify Next

Do not test the site with real credentials or funds. Any claim to a regulated investment service should be checked directly against the relevant financial regulator's public register, searching by the operator's legal name rather than any name or link on this site. Anyone who reached the site through a message, advertisement, or "claim" link should trace that message back to its sender and confirm through an independent, offline route that the sender actually issued it. Official support and contact channels should likewise be confirmed independently. Anyone who has already entered passwords or wallet details should change those credentials immediately and review the affected accounts for unauthorized activity. Evidence:

• Homepage: the investment-style proposition has no confirmable regulated operator.
• Homepage: three password forms mean credential exposure is the most immediate concern for anyone who has already interacted.
• Registration records: the one-year-old, months-old domain gives no established history against which to benchmark the claims.

Summary Verdict

The overall posture is high-risk and clearly cautionary. Independent threat-intelligence listings, a very young domain, and aggressive page behavior converge on the same conclusion. Basic technical hygiene is present, but it does not mitigate the reputation findings. The operator's real-world identity is unverified, and the site is unsuitable for any sensitive interaction.

Infrastructure Integrity

The site sits behind a mainstream CDN and web application firewall provider, and all observed addresses are edge servers. This is a mitigating factor only. It shows that the site's operator uses reputable edge services. It does not show that the operator is legitimate, and it does not offset the threat listings. Because only edge addresses are visible, the true hosting origin cannot be independently verified, and page content could be swapped quickly without any change to the visible infrastructure. A lightly populated set of subdomains on such a young domain is an unconfirmed heuristic only and carries no weight beyond the confirmed findings above.

Closing Assessment

The site should be treated as unsafe for logins, credential entry, wallet connection, and any payment or investment activity. At most, it should be viewed passively from an isolated, non-primary device, and nothing should be downloaded or submitted. Anyone who has already engaged should report the link to the relevant platform or authority.