Verdict
This assessment found strong scam indicators. Do not pay, sign in, or share personal details with this site.
convexfi.org shows high-risk / scam indicators.
Evidence status and limitations
Evidence completeness: Not recorded
- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.
At a glance
The checks that decide most of this verdict.
| Malware engines | 15 flagged itVirusTotal | Risk |
|---|---|---|
| Google Safe Browsing | Not listedGoogle | Clear |
| Abuse reports on the host | 0% confidenceAbuseIPDB, 0 reports; shared hosting inflates reports | Clear |
| Domain age | 3.0 years oldRegistered history | Clear |
| Web archive | 4 snapshots4 snapshots | Clear |
| Certificate | Encrypted connectionIssued by WE1 | Noted |
The page as captured
Key findings
- Automated classification: Sensitive Interaction Risk.
- Domain age: 1 to 3 years (registration continuity).
- At least one reputation service TrustSniffer consulted had flagged this domain at assessment time.
Full analysis
Security Alert
Fortinet, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.
The website at convexfi.org presents a single-page, finance-branded front under the title "Convex Finance". It appears to be an online financial or crypto-asset service property, but the evidence captured does not establish specific products, yields or terms. The homepage loads normally and delivers a modest amount of text content. Its apparent purpose is to attract visitors to a finance-oriented service under that brand name.
Scam/Impersonation Risk
This is the decisive area of the assessment. The domain is currently flagged by a substantial cluster of independent security engines, including two top-tier vendors, and the aggregate detection level is high enough to be treated as a confirmed blacklist condition. Infrastructure protections and the technically clean transport layer cannot offset this reputational damage. The detections are not attributed to a specific abuse type such as phishing, malware or impersonation, so the exact nature of the listing remains unspecified. In the absence of a stated cause, the listing is treated as an active warning for any sensitive interaction. No conflicting legal identities and no confirmed brand impersonation were observed. Behavioural testing also found no wallet-drainer activity, clipboard manipulation, hidden forms or credential posts to external destinations. These mitigate the picture but do not outweigh the listing. The domain's current registration record is recent compared with its earlier web footprint, which is consistent with a change in control, although the evidence does not show who now operates it.
- Homepage and network behaviour: three of three sandbox runs completed with stable HTTP 200 responses, with 27 external XHR/fetch calls and 9 external POSTs, none to non-whitelisted destinations. No wallet connection attempts, clipboard writes or hidden forms were detected.
- Security-engine reputation: 15 malicious and 1 suspicious verdicts, including from two tier-one vendors, and an additional external blacklist hit.
- Domain provenance: WHOIS creation date of 2026-07-08 (~0.3 years on the current registration record). The web-archive shows only 4 snapshots, all from 2023 (1 year tracked).
- Browser console: 9 console errors during page execution, with roughly 98% of the observed external request share going to third-party hosts.
Regulatory Verification Notes
No licence, registration number or regulated-entity affiliation is recognised for this site in the available evidence. The state of on-page legal and identity disclosure is unclear, and the real-world operator is not independently verified. On this basis, the site cannot be treated as a supervised financial service. This is a verification gap and not evidence of wrongdoing in itself. Its weight is increased here because it coincides with the adverse third-party detections. No third-party broker-reputation record matched the domain. The domain was registered through Key-Systems GmbH, a corporate registrar, with registrant details withheld under standard privacy protection. This is treated as an administrative detail and not as an identity contradiction.
- Registration record: registered through Key-Systems GmbH on 2026-07-08 and valid to 2027-07-08, with registrant data redacted for privacy.
- Hosting: served from AS13335 (CLOUDFLARENET, US).
- Transport security: TLS certificate issued by WE1 (domain-validated, DV), valid to 2026-12-04 and expiring in roughly 38 days. DV certification confirms control of the domain only, not the operator's identity.
- Homepage: no regulator name, licence reference or corporate registration number was captured.
What to Verify Next
Before any engagement, confirm through an independent, offline route that this domain is the official property of the "Convex Finance" brand it presents, for example via a verified social or documentation channel reached without using links from this site. Re-check the domain's security-engine standing later, since a changed or cleaned listing would alter the risk picture and a persisting one would confirm it. Where any financial offering is claimed, request the operating entity's name and licence reference and confirm them directly with the relevant regulator's public registry. Contact and support channels should be validated through that same independent route before any correspondence.
- Homepage: it presents the brand name but, in the captured content, no verifiable legal entity or regulatory reference.
- Reputation: active adverse detections from multiple engines remain the primary reason for independent confirmation.
- Registration: the domain's current registration dates from July 2026, so any claim of long brand continuity should be validated externally.
Summary Verdict
The overall posture is high-risk. Strong adverse reputation findings from multiple independent sources dominate the assessment and override the otherwise unremarkable technical hygiene. Legitimacy cannot be inferred from the site's presentation or its encrypted delivery, and the operator's real-world identity remains unverified.
Infrastructure Integrity
The site sits behind Cloudflare's CDN and WAF, and all observed addresses are edge nodes, so the origin server is not observable. The TLS certificate is valid and from a recognised issuer, and bot protection is active. These are mitigating factors only. Edge-only visibility also prevents independent verification of the hosting and can conceal rapid content changes. Protective infrastructure therefore does not offset the external threat detections.
Closing Assessment
The site should be limited to read-only viewing at most. Account login, credential entry, wallet connection and any payment or financial transaction should be avoided until the external detections are cleared and the operator is independently confirmed.
Written analysis generated 2026-10-27 by the TrustSniffer Analysis Engine from the evidence in this report.
What the analysis found
4 findings contributed to this verdict, raised by governance, external reputation, behaviour in a sandbox, registration and ownership.
01 Governance
- A threat feed lists this domain as malicious, and that caps the score whatever the other checks found.Governance
rule:GOV_CRITICAL_BLACKLIST
02 External reputation
- An external threat feed lists this domain: either Google Safe Browsing marked it malicious, or a significant number of malware engines flagged it.External reputation
rule:EXT_BLACKLIST_CRITICAL
03 Behaviour in a sandbox
- Most of what the page loaded came from other domains rather than from this one.Behaviour in a sandbox
rule:BEHAV_EXTERNAL_RATIO_HIGH - The page produced an unusually high number of errors while it ran.Behaviour in a sandbox
rule:BEHAV_CONSOLE_ERRORS_HIGH
04 Registration and ownership
- The registration record withholds contact details for the operator.Registration and ownership
rule:KF_WHOIS_HIDDEN - Registration details are held behind a privacy service, so no operator is named publicly. This is common and legal, and it also means there is nobody to check.Registration and ownership
rule:KF_WHOIS_PRIVATE
Identity verification
| Status | UNKNOWN |
|---|---|
| Identity score | 50/100 |
| Identity verification confidence | 15% |
- AI page analysis unavailable (page captured; identity not AI-verified)
Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence.
What TrustSniffer observed
First-party facts recorded during the assessment of convexfi.org.
- The request stayed on convexfi.org. It was not redirected to another domain. Clear
- Registration is published under Key-Systems GmbH. Clear
- DNS for this domain is served by cloudflare.com, across 2 name servers. Noted
- The registration is paid up to 2027-07-08. Noted
- It is hosted on CLOUDFLARENET, from a server in US. Noted
Domain intelligence
| Registrar | Key-Systems GmbH |
|---|---|
| Hosting | CLOUDFLARENET - Cloudflare, Inc., US |
| Country | US |
| Server IP | 2606:4700:3030::ac43:d29a |
| Name servers | roan.ns.cloudflare.com, roxy.ns.cloudflare.com |
| CDN / edge network | Detected (cloudflare) |
| Resolved IP addresses | 4 |
| Edge IP addresses | 4 |
| Likely origin IP addresses | 0 |
| SSL issuer | WE1 |
| SSL expiry | 2026-12-04 |
| Domain age | 2.97 years (continuous registration) |
| Domain expiry | 2027-07-08 |
| Archive first seen | Not available |
| Archive snapshots | 4 |
| Reputation | VirusTotal: 15 flagged | AbuseIPDB: 0% confidence, 0 reports | Google Safe Browsing: 0 matches |
About this assessment
A trust score summarises the evidence TrustSniffer could collect about convexfi.org at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.
TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.