Is coredex.help a scam? TrustSniffer's high-risk assessment: 9/100

Overview

The website coredex.help is a single-page site titled "The Decentralized Protocol," which presents itself as a decentralized protocol project. The page loads normally and returns a stable response on repeated visits. The captured content did not allow a reliable determination of the operator's identity or of any specific product or service the site offers.

Scam/Impersonation Risk

This is the decisive area of concern. Multiple independent threat-intelligence sources currently flag the domain as malicious or suspicious, and the domain is blacklisted by an external reputation feed. These detections outweigh every neutral or positive technical signal. No conflicting legal entities and no brand impersonation were observed on the page, so the risk comes from reputation and provenance, not from contradictory identity claims. The domain was registered only a couple of months ago, and its public footprint is sparse. Together with the active detections, this matches the lifecycle of short-lived domains set up to attract deposits or wallet interactions before they are flagged and abandoned. Under this pattern, the generic "decentralized protocol" branding on the homepage cannot be treated as evidence of a real project. Sandbox runs found no wallet-draining, clipboard-hijacking, hidden-form or credential-exfiltration behavior. The absence of that behavior in three runs does not offset the active blacklisting, because content can be swapped after a clean scan. The browser console also logged repeated errors on the homepage. Evidence:

• Homepage and domain-level reputation: three independent threat-intelligence sources report the domain as malicious and one more as suspicious, and an external blacklist lists it.
• Homepage: the page is titled "The Decentralized Protocol" and makes no verifiable claim tying it to an established project or organization.
• Domain registration: registered 2026-08-24 (~0.17 years, about 62 days old), which is very recent and fits the pattern described above.
• Homepage behavior: three successful sandbox runs showed no external network calls, but the browser console logged nine errors.

Regulatory Verification Notes

The captured site content gave no confirmed legal entity, licensing status or regulatory registration, and no independent registry or broker-review source could be matched to the domain. The registration record is masked by a privacy service. This is an administrative limitation and is not treated here as an identity contradiction. The site's identity could not be independently verified, so nothing on it can be treated as proof of a real-world operator. Any claim the page makes about being a protocol or platform is therefore unsupported. Given the active detections, the missing registration details are not a minor transparency note and add to the cautionary picture. Evidence:

• Domain registration: registered through NameSilo, LLC on 2026-08-24, expiring 2027-08-24, with owner details withheld by a privacy service.
• Transport encryption: the TLS certificate was issued by WE1 at domain-validation (DV) level and is valid to 2027-01-20. This confirms only that the connection is encrypted, not who runs the site.
• Hosting: served from AS13335 (Cloudflare, Inc., US).
• Third-party broker reputation: no match was found, so no regulatory or broker-review context exists for the domain.

What to Verify Next

Verification should start from the premise that the site is not safe for sensitive use. Anyone who encountered the domain through a message, advertisement or social post should trace that source and treat it as suspect. The claimed project should be located through independently established channels, such as an official listing or a documented project repository. These must be checked to see whether they reference this exact domain, and the domain should not be assumed to be the project's official address. No wallet connection, deposit or credential entry should happen before that confirmation, and official support channels should be confirmed through an independent route. If the domain was reached through a link sent by someone claiming to represent a project or service, that sender should be contacted through a separate, previously known channel. Evidence:

• Homepage: it offers no verifiable link to a named organization, so the project's real identity must be established outside the site.
• Reputation status: active detections from several sources mean any current "clean" appearance on the page itself carries little weight.
• Domain registration: the domain is only weeks old, so no long-standing independent record exists to corroborate it.

Summary Verdict

The overall posture is high-risk. Active malicious and blacklist detections combined with a very recent registration produce a clear elevated-risk assessment. The identity of whoever operates the site could not be independently established. The technical hygiene signals are consistent with a functioning site but do not mitigate the reputation findings.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and WAF. All observed addresses are edge servers, and the origin server was not visible. The TLS certificate is valid and issued by a known authority. This is a mitigating factor only. Edge-only visibility prevents independent verification of where the content is actually hosted and allows content to be changed quickly without any visible change in infrastructure. Protective infrastructure cannot offset the active reputation findings. The young domain with sparse subdomains is an unconfirmed heuristic and is weighed only as supporting context.

Closing Assessment

The domain is suitable at most for passive, read-only viewing. Account login, credential entry, wallet connections and any financial transaction should be avoided until the operator is independently identified and the active threat detections are cleared.