Verdict
This assessment found strong scam indicators. Do not pay, sign in, or share personal details with this site.
devwatchaudit.casa shows high-risk / scam indicators.
Evidence status and limitations
Evidence completeness: Not recorded
- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.
At a glance
The checks that decide most of this verdict.
| Malware engines | 4 flagged itVirusTotal | Risk |
|---|---|---|
| Google Safe Browsing | Not listedGoogle | Clear |
| Abuse reports on the host | 0% confidenceAbuseIPDB, 0 reports; shared hosting inflates reports | Clear |
| Domain age | 1 months oldMost scam domains are under a year old | Risk |
| Certificate | Encrypted connectionIssued by WE1 | Noted |
| Hosted by | CLOUDFLARENETServer in US | Noted |
The page as captured
Key findings
- Automated classification: Sensitive Interaction Risk.
- Domain age: less than 1 year (registration continuity).
- At least one reputation service TrustSniffer consulted had flagged this domain at assessment time.
Full analysis
Security Alert
Fortinet flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.
The website devwatchaudit.casa is a single-landing-page property titled "DEVWATCH — Solana Wallet Analysis". It presents itself to visitors as a tool for analysing Solana blockchain wallets, and its apparent purpose is a crypto-asset analytics or audit service aimed at wallet holders and token traders. The homepage carries a short body of text. Automated semantic review of that text was unavailable, so the specific features and claims it makes could not be itemised.
Scam/Impersonation Risk
Contradictory signals are present and serious. The domain is blacklisted by external threat-intelligence sources. Several independent security engines currently flag it as malicious, and others mark it suspicious, including a tier-one security vendor. This is a confirmed reputational contradiction, not a soft signal. The domain was also registered only weeks ago, which fits the disposable, short-lived pattern common to phishing and drainer infrastructure that targets crypto users. A Solana wallet-analysis lure is a typical pretext for getting visitors to connect a wallet or paste a seed phrase. Behavioural testing of the homepage did not observe wallet-connection prompts, clipboard tampering, hidden credential forms, cloaking or drainer routines, and every outbound request went to a known third-party service. These results are mitigating, but they do not outweigh the blacklisting. Page behaviour can change without notice, so a clean sandbox run on a newly registered, flagged domain is weak reassurance. No brand impersonation or conflicting legal identities were observed.
- Homepage: external security engines report multiple malicious and suspicious verdicts, and one tier-one vendor flags the domain.
- Domain registration: created 2026-09-09 through NameSilo, LLC, about 0.12 years (~43 days) old at analysis.
- Homepage behaviour: across three successful sandbox runs, no wallet-connect, clipboard-write, hidden-form or cloaking activity was detected. A large share of requests (about 82% at peak) went to external hosts, three of them external POST submissions.
Regulatory Verification Notes
The site discloses no licensing, registration or regulatory standing on the captured page, and no regulator or third-party broker dataset links it to any supervised entity. This is a verification gap rather than proof of wrongdoing. Here, however, it sits alongside confirmed threat detections, and nothing independent offsets it. The real-world operator behind the site has not been independently connected to any named person or company. Any claim of legitimacy would therefore rest on the site's own assertions and cannot be treated as established. Transport encryption is in place, but it is a basic domain-validated certificate. It proves only that the connection is encrypted and says nothing about who operates the site.
- Homepage: no company name, licence number or regulator reference was captured in the page content.
- Transport encryption: TLS certificate issued by WE1 (DV, domain-validated only), valid to 2026-12-08, with about 46 days remaining.
- Hosting: served from AS13335 (Cloudflare, Inc., US).
What to Verify Next
Do not treat this site as safe to transact with until the external detections are resolved or clarified. Check the domain's current status with the originating security vendors and public threat-intelligence databases, and recheck it after any remediation claim. If the service is said to belong to a known project or team, confirm it through that party's established channels, such as its verified social accounts or documentation reached independently of this site. Confirm the official support and contact channels offline. If any regulated activity is claimed, check the relevant registry directly.
- Homepage: the Solana wallet-analysis offering is not tied to any named, checkable organisation.
- External reputation: the current malicious and suspicious detections are the main open question for the operator to explain.
- Domain registration: the domain is weeks old, so no long operating record exists to rely on.
Summary Verdict
The site is assessed as high risk and carries a clearly cautionary posture. Confirmed blacklisting by external threat sources, combined with a very recent registration and an unverified operator, outweighs the technical hygiene signals. Those signals include valid encryption and clean sandbox behaviour. Legitimacy cannot be inferred from this evidence.
Infrastructure Integrity
The site is fronted by Cloudflare's CDN and WAF. All four observed addresses, IPv4 and IPv6, are edge nodes, and the origin server could not be seen. Cloudflare is a reputable provider, and its use mitigates exposure to common attacks. It does not vouch for the content or the operator. Because only edge addresses are visible, the actual hosting cannot be independently verified, and the site's content could be swapped quickly without any visible change in infrastructure. This posture is a mitigating factor only and cannot offset the external threat detections.
Closing Assessment
The site should be restricted to passive viewing at most. No wallet connection, login, credential or seed-phrase entry, or financial transaction should be made on it. Anyone who has already interacted with it should review wallet permissions and revoke any approvals.
Written analysis generated 2026-10-22 by the TrustSniffer Analysis Engine from the evidence in this report.
What the analysis found
4 findings contributed to this verdict, raised by external reputation, hosting and network, behaviour in a sandbox, registration and ownership.
01 External reputation
- An external threat feed lists this domain: either Google Safe Browsing marked it malicious, or a significant number of malware engines flagged it.External reputation
rule:EXT_BLACKLIST_CRITICAL
02 Hosting and network
- The domain was registered less than three months ago.Hosting and network
rule:DNS_NEW_DOMAIN_90D
03 Behaviour in a sandbox
- Most of what the page loaded came from other domains rather than from this one.Behaviour in a sandbox
rule:BEHAV_EXTERNAL_RATIO_HIGH
04 Registration and ownership
- The registration record withholds contact details for the operator.Registration and ownership
rule:KF_WHOIS_HIDDEN - Registration details are held behind a privacy service, so no operator is named publicly. This is common and legal, and it also means there is nobody to check.Registration and ownership
rule:KF_WHOIS_PRIVATE
Identity verification
| Status | UNKNOWN |
|---|---|
| Identity score | 50/100 |
| Identity verification confidence | 15% |
- AI page analysis unavailable (page captured; identity not AI-verified)
Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence.
What TrustSniffer observed
First-party facts recorded during the assessment of devwatchaudit.casa.
- The request stayed on devwatchaudit.casa. It was not redirected to another domain. Clear
- Registration is published under NameSilo, LLC. Clear
- DNS for this domain is served by cloudflare.com, across 2 name servers. Noted
- The registration is paid up to 2027-09-09. Noted
- It is hosted on CLOUDFLARENET, from a server in US. Noted
Domain intelligence
| Registrar | NameSilo, LLC |
|---|---|
| Hosting | CLOUDFLARENET - Cloudflare, Inc., US |
| Country | US |
| Server IP | 2606:4700:3037::ac43:84f2 |
| Name servers | toby.ns.cloudflare.com, phoenix.ns.cloudflare.com |
| CDN / edge network | Detected (cloudflare) |
| Resolved IP addresses | 4 |
| Edge IP addresses | 4 |
| Likely origin IP addresses | 0 |
| SSL issuer | WE1 |
| SSL expiry | 2026-12-08 |
| Domain age | 0.12 years (continuous registration) |
| Domain expiry | 2027-09-09 |
| Archive first seen | Not available |
| Archive snapshots | Not counted (archive lookup incomplete) |
| Reputation | VirusTotal: 4 flagged | AbuseIPDB: 0% confidence, 0 reports | Google Safe Browsing: 0 matches |
About this assessment
A trust score summarises the evidence TrustSniffer could collect about devwatchaudit.casa at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.
TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.