Is deagent.my safe? TrustSniffer's low-trust assessment: 32/100

Overview

The website at deagent.my presents itself under the title "DeAgent AI". It is a very recently registered, single-page-entry property on the Malaysian country-code domain, and it carries branding that suggests an AI-agent product or service. The automated capture of the homepage reached a bot-verification challenge, so the visible offering, any pricing or yield claims, and the operating business model could not be read directly from page content. The site's apparent purpose is therefore inferred only from its name and its recent launch.

Scam/Impersonation Risk

Contradictory signals are present, and they are the decisive factor in this assessment. An external threat-intelligence source currently lists the domain as malicious, and a second detection engine marks it suspicious. This is a confirmed blacklist hit, not a stylistic or inferential concern. It is amplified by the site's age, because the domain was registered only a couple of months before analysis, with almost no independent history to counter the adverse listing. No conflicting legal-entity names, brand impersonation, or page-level phishing content were observed. However, the page content could not be inspected in depth, so the absence of such findings is limited by the capture and is not an affirmative clearance. The behavioural run produced no wallet-connection prompts, clipboard manipulation, hidden forms, or credential posts to external parties. That is a mitigating observation, but it does not offset a live blacklist listing on a newly created domain. The site should be treated as high-risk for any sensitive interaction. Evidence:

• Homepage and domain-level reputation: one malicious and one suspicious detection recorded, with a blacklist hit confirmed by an external feed.
• Registration record: domain created 2026-08-21 (~0.17 years old), with the registrant concealed behind a privacy service.
• Web-archive record: 1 snapshot, first and last seen 2026-09-27 (1 year tracked), so there is no meaningful prior history to contextualise the listing.
• Homepage behaviour: three consecutive sandbox visits returned stable responses, with no wallet-drainer, clipboard-hijack, or hidden-form activity.

Regulatory Verification Notes

The material available contains no licence, registration number, regulator reference, or named operating company that could be assessed, and the extent of on-page disclosure remains unclear because the homepage was gated by a bot challenge during capture. No independent source connects the site to a real-world brand or person, so its identity is unconfirmed and no claim of legitimacy can be supported. The registration privacy applied through the registrar's proxy service is an ordinary administrative practice and is not treated here as an identity contradiction. No third-party broker or regulatory-database match was found, which means no external regulatory standing is on record either way. Any financial, custodial, or investment-style activity on the site would require independent regulatory confirmation before it could be considered. Evidence:

• Homepage: capture blocked by a Cloudflare bot challenge, so legal and terms pages could not be assessed for entity names or licence statements.
• Registration record: registrar Dynadot, LLC; registrant listed as "REDACTED FOR PRIVACY" via Super Privacy Service LTD c/o Dynadot; expiry 2027-08-21.
• Transport security: TLS certificate issued by WE1 at DV level, valid to 2027-01-17, which confirms encryption only and nothing about operator identity.

What to Verify Next

Verification should start with the operator, not the website. The business entity behind the AI-agent offering, if any, should be confirmed through an official company or financial-services registry in its claimed jurisdiction. Where the site claims or implies regulated activity, the named regulator's public register should be checked directly. Official contact and support channels should be confirmed through an independent route, such as a verified social profile or documentation linked from a recognised third party, and not through links on the site. The status of the current blacklist listing should be rechecked against the original listing source before any decision to interact is revisited. Evidence:

• Homepage: no verifiable operator identity could be read from the captured page.
• Domain record: registration only a couple of months old, with no established history to rely on.
• Reputation record: active adverse listing that should be re-examined at source for date and category.

Summary Verdict

The assessment is cautionary and security-forward. A confirmed adverse reputation listing on a newly registered, identity-unverified domain outweighs the technical hygiene signals, which are limited to sound encryption and stable page behaviour. The site is not shown to be legitimate and is classed as elevated risk, with sensitive interaction considered unsafe.

Infrastructure Integrity

The site is served entirely from Cloudflare infrastructure (AS13335, United States), and every observed address is a CDN edge node, so the origin host was not observable. The edge protection and a valid DV certificate are mitigating factors only. They do not establish legitimacy, and they cannot offset the reputation listing. Edge-only visibility also prevents independent hosting verification and can mask rapid content changes. An unconfirmed heuristic notes the sparse subdomain footprint typical of a young domain.

Closing Assessment

Use should be limited to read-only viewing, if the site is visited at all. Account logins, credential entry, wallet connections, and any payment or financial transaction should be avoided until the adverse listing is cleared and the operator is independently identified.