--- title: "Is dachain.icu Safe? Risk Report, Score 32/100" source: TrustSniffer type: Website trust & fraud report subject: "dachain.icu" verdict: "Low Trust" title: "Is dachain.icu Safe? Warning Signs, Score 32/100" trust_score: 32 classification_confidence: 75 canonical_url: https://trustsniffer.com/report/dachain.icu assessed: 2026-10-19 --- # Is dachain.icu safe? TrustSniffer's low-trust assessment: 32/100 ## Verdict **Verdict: Low Trust, trust score 32/100.** dachain.icu is low-trust and potentially risky. Several risk patterns were present. Do not send money or personal details until you have verified this business another way. Labels: Sensitive Interaction Risk Assessed 2026-10-19 by automated analysis. Classification confidence 75%. | Field | Value | | --- | --- | | What this site appears to be | Server-generated notice in English and Russian that the hosting account is disabled by the server administrator. The page has no forms, links, or commercial content, and footer text credits ISPsystem. | ## Evidence status and limitations Evidence completeness: Not recorded - The real-world operator identity was not independently verified. - Module-level completeness metadata is unavailable for this legacy report. ## At a glance The checks that decide most of this verdict. | Check | Result | Status | | --- | --- | --- | | Malware engines | 1 flagged it (VirusTotal) | Risk | | Google Safe Browsing | Not listed (Google) | Clear | | Abuse reports on the host | 0% confidence (AbuseIPDB, 0 reports; shared hosting inflates reports) | Clear | | Domain age | 26 days old (Most scam domains are under a year old) | Risk | | Web archive | Archived since 2026 (2 snapshots) | Clear | | Certificate | Encrypted connection (Issued by YE2) | Noted | ## The page as captured ![Screenshot of the dachain.icu homepage captured during the TrustSniffer assessment](https://trustsniffer.com/outputs/dachain.icu/screenshots/first.png) _What dachain.icu served when TrustSniffer captured it on 2026-10-19. The page may look different now._ ## Key findings - Automated classification: Sensitive Interaction Risk. - Domain age: less than 1 year (registration continuity). - Public web-archive history exists since 2026. - At least one reputation service TrustSniffer consulted had flagged this domain at assessment time. ## Full analysis ### Overview The website at this domain currently presents only a bare server-generated notice, in English and Russian, stating that the hosting account has been disabled by the server administrator. The notice credits a commercial hosting control-panel vendor in its footer. The page has no forms, links, navigation, branding, products or monetization. Its apparent purpose cannot be inferred beyond being a placeholder or suspended-account page for a very recently registered domain. ### Scam/Impersonation Risk The central concern is a confirmed external blacklist hit. At least one external reputation source rates the domain as malicious and another as suspicious, and no mainstream browser-protection list flags it. The page itself shows no brand impersonation, no login form, no hidden forms, no wallet interaction, no clipboard manipulation and no cloaking, so the blacklist hit is the only contradiction. Browser-behavior testing adds a secondary concern. A very large share of the page's network traffic went to third-party destinations, including repeated external POST and XHR requests to destinations outside the expected allow-list. A page that displays no content and has no visible forms would not normally need that outbound activity, so the data flows are unexplained. The domain's extreme newness raises the weight of these signals, because short-lived domains are commonly staged for later redirection or content swaps. No conflicting legal identities were observed. Evidence: - Homepage: the only content is the account-disabled notice, with no forms, links or commercial claims. - Homepage behavior testing: 33 external requests, including 18 external POSTs (3 to non-allow-listed destinations) and 15 external XHR calls (3 to non-allow-listed destinations); external traffic peaked at 97.2% of requests in one run. - Domain registered 2026-09-22 (~0.07 years, about 26 days old); web archive holds only 2 snapshots, both captured 2026-09-23, with 1 year tracked. ### Regulatory Verification Notes The site has no legal, terms, privacy or about pages, and it makes no claim to any license, registration number or regulated activity. No legal entity can be assessed, and the on-site disclosure position is unclear because the only content is a hosting notice. That is a verification gap, not evidence of misconduct. No third-party broker or regulatory-database record was matched for this domain, so there is no independent corroboration of any operator or business. The identity of the operator is unverified and should not be assumed from the hosting-vendor branding on the page. The domain was registered through the reputable corporate registrar PDR Ltd. d/b/a PublicDomainRegistry.com, and the registrant details are masked under GDPR practice, which is routine and carries no weight here. Evidence: - Homepage: no company name, license, registration number or contact details are published. - Registered through PDR Ltd. d/b/a PublicDomainRegistry.com, with registration running to 2027-09-22. - Served from AS13335 (Cloudflare, Inc., US); the TLS certificate was issued by YE2 (DV), valid to 2026-12-21 (63 days remaining), which shows only encryption of the connection and nothing about the operator. ### What to Verify Next Before any engagement, the operator's real identity and purpose should be established by independent routes. A counterparty claiming to operate through this domain should be asked for a registered legal entity name, which can then be checked against the relevant company registry and, if the activity is financial, the applicable licensing authority. Any official contact channels should be confirmed through an independent route and not through details supplied by the domain itself. The domain should be re-assessed after the blacklist entry is reviewed, to see whether it is removed, whether real content appears, and whether the outbound third-party traffic persists. Evidence: - Homepage: no operator identity, product or service is described that could be checked. - The domain is about 26 days old, which leaves almost no operating history to rely on. - Reputation sources currently disagree on severity (one malicious, one suspicious detection), so the entry should be rechecked directly. ### Summary Verdict The assessment is **elevated risk**. The domain is brand new, its operator is unverified, and it is blacklisted by an external reputation source. It also shows unexplained third-party data flows behind an empty page. Nothing in the evidence shows impersonation or an active phishing mechanism, but the blacklist hit and the lack of any legitimate content or history prevent a favorable reading. ### Infrastructure Integrity The domain resolves entirely to Cloudflare edge addresses, and the origin server was not observable. The TLS certificate is valid, and the abuse database shows no reports and treats the addresses as shared CDN infrastructure. These are mitigating factors only. They show that the site is behind mainstream protective infrastructure, but they do not vouch for the operator. They also cannot offset the external threat detection. Edge-only visibility means the hosting cannot be independently confirmed and could conceal a rapid content change behind the same address. ### Closing Assessment The site should be treated as unsafe for login, credential entry, payments or any financial interaction. Passive, read-only viewing is the only proportionate use until the blacklist entry is cleared and a verifiable operator emerges. _Written analysis generated 2026-10-19 by the TrustSniffer Analysis Engine from the evidence in this report._ ## What the analysis found 5 findings contributed to this verdict, raised by external reputation, hosting and network, history in the web archive, page content, behaviour in a sandbox. ### 01 External reputation - A small number of malware engines flagged this domain. On its own this is a weak signal. (External reputation `rule:EXT_BLACKLIST_MEDIUM`) ### 02 Hosting and network - The domain was registered less than three months ago. (Hosting and network `rule:DNS_NEW_DOMAIN_90D`) ### 03 History in the web archive - The web archive has almost no record of this domain, which fits a site that is new. (History in the web archive `rule:ARCH_PEN_YOUNG_AND_SPARSE`) ### 04 Page content - The page has very little readable content. (Page content `rule:PAGE_CONTENT_THIN`) ### 05 Behaviour in a sandbox - Most of what the page loaded came from other domains rather than from this one. (Behaviour in a sandbox `rule:BEHAV_EXTERNAL_RATIO_HIGH`) - The page sent data to a destination TrustSniffer does not recognise. (Behaviour in a sandbox `rule:BEHAV_NONWHITELISTED_POSTS`) ## Identity verification | Field | Value | | --- | --- | | Status | UNVERIFIED | | Identity score | 30/100 | | Identity verification confidence | 50% | - No on-site identity signals detected _Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence._ ## What TrustSniffer observed First-party facts recorded during the assessment of dachain.icu. - The request stayed on dachain.icu. It was not redirected to another domain. (Clear) - Registration is published under PDR Ltd. d/b/a PublicDomainRegistry.com. (Clear) - DNS for this domain is served by cloudflare.com, across 2 name servers. (Noted) - The registration is paid up to 2027-09-22. (Noted) - The earliest public archive of this site is from 2026-09-23. (Clear) - It is hosted on CLOUDFLARENET, from a server in US. (Noted) ## Domain intelligence | Field | Value | | --- | --- | | Registrar | PDR Ltd. d/b/a PublicDomainRegistry.com | | Hosting | CLOUDFLARENET - Cloudflare, Inc., US | | Country | US | | Server IP | 2606:4700:3036::6815:2596 | | Name servers | ANDRONICUS.NS.CLOUDFLARE.COM, SIMA.NS.CLOUDFLARE.COM | | CDN / edge network | Detected (cloudflare) | | Resolved IP addresses | 4 | | Edge IP addresses | 4 | | Likely origin IP addresses | 0 | | SSL issuer | YE2 | | SSL expiry | 2026-12-21 | | Domain age | 0.07 years (continuous registration) | | Domain expiry | 2027-09-22 | | Archive first seen | 2026-09-23 | | Archive snapshots | 2 | | Reputation | VirusTotal: 1 flagged \| AbuseIPDB: 0% confidence, 0 reports \| Google Safe Browsing: 0 matches | ## About this assessment **Was this report useful?** Tell other people what you think of TrustSniffer, good or bad. An honest review helps others decide whether to rely on these checks. [Review TrustSniffer on Trustpilot](https://www.trustpilot.com/review/trustsniffer.com) A trust score summarises the evidence TrustSniffer could collect about dachain.icu at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present. TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed. ## Related on TrustSniffer - [dachain.ink](https://trustsniffer.com/report/dachain.ink), same name on .ink (Low Trust, 34/100) - [fermah.icu](https://trustsniffer.com/report/fermah.icu), another .icu site assessed as low-trust (Low Trust, 40/100) - [zrc20.icu](https://trustsniffer.com/report/zrc20.icu), another .icu site assessed as low-trust (Low Trust, 41/100) - [portal-moonshot-dsx.netlify.app](https://trustsniffer.com/report/portal-moonshot-dsx.netlify.app), another site assessed as low-trust (Low Trust, 25/100) - [crypto-jnp.netlify.app](https://trustsniffer.com/report/crypto-jnp.netlify.app), another site assessed as low-trust (Low Trust, 25/100) - [portal-moonshot-ixz.netlify.app](https://trustsniffer.com/report/portal-moonshot-ixz.netlify.app), another site assessed as low-trust (Low Trust, 25/100) - [crypto-je9.netlify.app](https://trustsniffer.com/report/crypto-je9.netlify.app), another site assessed as low-trust (Low Trust, 25/100) - [portal-moonshot-5ay.netlify.app](https://trustsniffer.com/report/portal-moonshot-5ay.netlify.app), another site assessed as low-trust (Low Trust, 25/100) - [portal-moonshot-avq.netlify.app](https://trustsniffer.com/report/portal-moonshot-avq.netlify.app), another site assessed as low-trust (Low Trust, 25/100) - [crypto-xft.netlify.app](https://trustsniffer.com/report/crypto-xft.netlify.app), another site assessed as low-trust (Low Trust, 25/100) - [Every website and wallet TrustSniffer has assessed](https://trustsniffer.com/directory), the full risk directory - [Other domains assessed as high-risk or phishing](https://trustsniffer.com/directory/phishing-domains), same verdict band - [Check another website](https://trustsniffer.com/web-intelligence), run a new assessment - [Check a crypto wallet address](https://trustsniffer.com/on-chain-risk), on-chain screening - [The TrustSniffer Risk Index](https://trustsniffer.com/stats), how this verdict compares ## Guides - [Crypto Scam Websites in 2026: What a List Misses](https://trustsniffer.com/blog/crypto-scam-websites-2026-what-a-list-misses) - [Stablecoin Freezes, Oct 23, 2026: 8 Wallets](https://trustsniffer.com/blog/stablecoin-freeze-report-2026-10-23) - [How to check if TRC20 USDT is genuine Tether](https://trustsniffer.com/blog/how-to-check-if-trc20-usdt-is-genuine-tether) --- *Source: [TrustSniffer](https://trustsniffer.com/report/dachain.icu) — independent automated trust & fraud analysis. Cite as https://trustsniffer.com/report/dachain.icu · assessed 2026-10-19.*