Verdict
Several risk patterns were present. Do not send money or personal details until you have verified this business another way.
dachain.icu is low-trust and potentially risky.
| What this site appears to be | Server-generated notice in English and Russian that the hosting account is disabled by the server administrator. The page has no forms, links, or commercial content, and footer text credits ISPsystem. |
|---|
Evidence status and limitations
Evidence completeness: Not recorded
- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.
At a glance
The checks that decide most of this verdict.
| Malware engines | 1 flagged itVirusTotal | Risk |
|---|---|---|
| Google Safe Browsing | Not listedGoogle | Clear |
| Abuse reports on the host | 0% confidenceAbuseIPDB, 0 reports; shared hosting inflates reports | Clear |
| Domain age | 26 days oldMost scam domains are under a year old | Risk |
| Web archive | Archived since 20262 snapshots | Clear |
| Certificate | Encrypted connectionIssued by YE2 | Noted |
The page as captured
Key findings
- Automated classification: Sensitive Interaction Risk.
- Domain age: less than 1 year (registration continuity).
- Public web-archive history exists since 2026.
- At least one reputation service TrustSniffer consulted had flagged this domain at assessment time.
Full analysis
Overview
The website at this domain currently presents only a bare server-generated notice, in English and Russian, stating that the hosting account has been disabled by the server administrator. The notice credits a commercial hosting control-panel vendor in its footer. The page has no forms, links, navigation, branding, products or monetization. Its apparent purpose cannot be inferred beyond being a placeholder or suspended-account page for a very recently registered domain.
Scam/Impersonation Risk
The central concern is a confirmed external blacklist hit. At least one external reputation source rates the domain as malicious and another as suspicious, and no mainstream browser-protection list flags it. The page itself shows no brand impersonation, no login form, no hidden forms, no wallet interaction, no clipboard manipulation and no cloaking, so the blacklist hit is the only contradiction. Browser-behavior testing adds a secondary concern. A very large share of the page's network traffic went to third-party destinations, including repeated external POST and XHR requests to destinations outside the expected allow-list. A page that displays no content and has no visible forms would not normally need that outbound activity, so the data flows are unexplained. The domain's extreme newness raises the weight of these signals, because short-lived domains are commonly staged for later redirection or content swaps. No conflicting legal identities were observed.
- Homepage: the only content is the account-disabled notice, with no forms, links or commercial claims.
- Homepage behavior testing: 33 external requests, including 18 external POSTs (3 to non-allow-listed destinations) and 15 external XHR calls (3 to non-allow-listed destinations); external traffic peaked at 97.2% of requests in one run.
- Domain registered 2026-09-22 (~0.07 years, about 26 days old); web archive holds only 2 snapshots, both captured 2026-09-23, with 1 year tracked.
Regulatory Verification Notes
The site has no legal, terms, privacy or about pages, and it makes no claim to any license, registration number or regulated activity. No legal entity can be assessed, and the on-site disclosure position is unclear because the only content is a hosting notice. That is a verification gap, not evidence of misconduct. No third-party broker or regulatory-database record was matched for this domain, so there is no independent corroboration of any operator or business. The identity of the operator is unverified and should not be assumed from the hosting-vendor branding on the page. The domain was registered through the reputable corporate registrar PDR Ltd. d/b/a PublicDomainRegistry.com, and the registrant details are masked under GDPR practice, which is routine and carries no weight here.
- Homepage: no company name, license, registration number or contact details are published.
- Registered through PDR Ltd. d/b/a PublicDomainRegistry.com, with registration running to 2027-09-22.
- Served from AS13335 (Cloudflare, Inc., US); the TLS certificate was issued by YE2 (DV), valid to 2026-12-21 (63 days remaining), which shows only encryption of the connection and nothing about the operator.
What to Verify Next
Before any engagement, the operator's real identity and purpose should be established by independent routes. A counterparty claiming to operate through this domain should be asked for a registered legal entity name, which can then be checked against the relevant company registry and, if the activity is financial, the applicable licensing authority. Any official contact channels should be confirmed through an independent route and not through details supplied by the domain itself. The domain should be re-assessed after the blacklist entry is reviewed, to see whether it is removed, whether real content appears, and whether the outbound third-party traffic persists.
- Homepage: no operator identity, product or service is described that could be checked.
- The domain is about 26 days old, which leaves almost no operating history to rely on.
- Reputation sources currently disagree on severity (one malicious, one suspicious detection), so the entry should be rechecked directly.
Summary Verdict
The assessment is elevated risk. The domain is brand new, its operator is unverified, and it is blacklisted by an external reputation source. It also shows unexplained third-party data flows behind an empty page. Nothing in the evidence shows impersonation or an active phishing mechanism, but the blacklist hit and the lack of any legitimate content or history prevent a favorable reading.
Infrastructure Integrity
The domain resolves entirely to Cloudflare edge addresses, and the origin server was not observable. The TLS certificate is valid, and the abuse database shows no reports and treats the addresses as shared CDN infrastructure. These are mitigating factors only. They show that the site is behind mainstream protective infrastructure, but they do not vouch for the operator. They also cannot offset the external threat detection. Edge-only visibility means the hosting cannot be independently confirmed and could conceal a rapid content change behind the same address.
Closing Assessment
The site should be treated as unsafe for login, credential entry, payments or any financial interaction. Passive, read-only viewing is the only proportionate use until the blacklist entry is cleared and a verifiable operator emerges.
Written analysis generated 2026-10-19 by the TrustSniffer Analysis Engine from the evidence in this report.
What the analysis found
5 findings contributed to this verdict, raised by external reputation, hosting and network, history in the web archive, page content, behaviour in a sandbox.
01 External reputation
- A small number of malware engines flagged this domain. On its own this is a weak signal.External reputation
rule:EXT_BLACKLIST_MEDIUM
02 Hosting and network
- The domain was registered less than three months ago.Hosting and network
rule:DNS_NEW_DOMAIN_90D
03 History in the web archive
- The web archive has almost no record of this domain, which fits a site that is new.History in the web archive
rule:ARCH_PEN_YOUNG_AND_SPARSE
04 Page content
- The page has very little readable content.Page content
rule:PAGE_CONTENT_THIN
05 Behaviour in a sandbox
- Most of what the page loaded came from other domains rather than from this one.Behaviour in a sandbox
rule:BEHAV_EXTERNAL_RATIO_HIGH - The page sent data to a destination TrustSniffer does not recognise.Behaviour in a sandbox
rule:BEHAV_NONWHITELISTED_POSTS
Identity verification
| Status | UNVERIFIED |
|---|---|
| Identity score | 30/100 |
| Identity verification confidence | 50% |
- No on-site identity signals detected
Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence.
What TrustSniffer observed
First-party facts recorded during the assessment of dachain.icu.
- The request stayed on dachain.icu. It was not redirected to another domain. Clear
- Registration is published under PDR Ltd. d/b/a PublicDomainRegistry.com. Clear
- DNS for this domain is served by cloudflare.com, across 2 name servers. Noted
- The registration is paid up to 2027-09-22. Noted
- The earliest public archive of this site is from 2026-09-23. Clear
- It is hosted on CLOUDFLARENET, from a server in US. Noted
Domain intelligence
| Registrar | PDR Ltd. d/b/a PublicDomainRegistry.com |
|---|---|
| Hosting | CLOUDFLARENET - Cloudflare, Inc., US |
| Country | US |
| Server IP | 2606:4700:3036::6815:2596 |
| Name servers | ANDRONICUS.NS.CLOUDFLARE.COM, SIMA.NS.CLOUDFLARE.COM |
| CDN / edge network | Detected (cloudflare) |
| Resolved IP addresses | 4 |
| Edge IP addresses | 4 |
| Likely origin IP addresses | 0 |
| SSL issuer | YE2 |
| SSL expiry | 2026-12-21 |
| Domain age | 0.07 years (continuous registration) |
| Domain expiry | 2027-09-22 |
| Archive first seen | 2026-09-23 |
| Archive snapshots | 2 |
| Reputation | VirusTotal: 1 flagged | AbuseIPDB: 0% confidence, 0 reports | Google Safe Browsing: 0 matches |
About this assessment
A trust score summarises the evidence TrustSniffer could collect about dachain.icu at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.
TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.