Is dexfactory.app a scam? TrustSniffer's high-risk assessment: 6/100

Security Alert

Fortinet, Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

The website at dexfactory.app presents only a minimal landing page titled "Application placeholder," carrying a very small amount of visible text and no identifiable product description, company name, or service terms. The domain name suggests a decentralized-exchange or application-building theme, but the page itself states no business purpose or operating model. Its apparent function is therefore that of an unfinished or staging front end rather than a documented, operating service.

Scam/Impersonation Risk

Contradictory signals are present and weigh heavily. External reputation sources currently carry a confirmed blacklisting of the domain: two major security vendors classify it as malicious, and further detections mark it as suspicious. Automated browsing sessions also showed that the homepage changes materially in both its text and its layout once a visitor interacts with it. This pattern is characteristic of content that shows one face to passive scanners and another to active users, and it is a recognised evasion technique. The registration timeline adds to the concern. The domain appears in historical web archives from 2023, but its current registration began only recently. That is consistent with a previously existing domain that was re-registered, possibly by a new party, so the archive history cannot be treated as continuous operation under the current holder. Historical records also carry a prior phishing association for the domain. The current page content does not confirm phishing, and no brand impersonation or conflicting legal identities were observed. The blacklisting and the interaction-dependent behavior are enough on their own to place the site in a clearly cautionary category. Evidence:

• Homepage, automated sessions: content differed measurably in both text and visual layout after interaction, which triggered a strong cloaking classification.
• External reputation: 2 malicious and 2 suspicious detections, including two tier-one security vendors, and a blacklist flag corroborated across sources.
• Domain registration: created 2026-09-17 (~34 days old, 0.09 years), with expiry set for 2027-09-17.
• Web archive: 17 snapshots spanning 2023–2026 (4 years tracked), against a registration that began only weeks ago.

Regulatory Verification Notes

The homepage names no operating company, jurisdiction, licence, registration number, or terms of service, and the registration record does not reveal the registrant, which amounts to ownership opacity. The page does not make financial-service claims, so no licence can be assessed. Even so, the domain name implies an exchange or application-development function, and no regulatory standing is claimed or evidenced. The real-world operator cannot be connected to any recognised brand or person. No third-party broker or regulatory-database match exists for the domain, so the site has no external standing to offset the reputational findings. This is a transparency gap and not independent proof of fraud, but combined with the findings above it leaves no mitigating disclosure. Evidence:

• Homepage: placeholder text only, with no legal entity, licence, address, or policy pages.
• Registrar: domain registered through NICENIC International Group Co., Limited, with owner details hidden or incomplete.
• Transport security: TLS certificate issued by YE2 (domain-validated only), valid to 2026-12-16 with about 55 days remaining. Domain validation confirms control of the domain, not the identity of the operator.
• Hosting: served from AS13335 (Cloudflare, Inc., US). The domain does not appear in any DeFi protocol directory consulted.

What to Verify Next

Any engagement should wait until the operator is independently identified. The first step is to ask the claimed operator, through a channel found outside this site, to confirm that they control the domain and to state the legal entity behind it. Corporate registries in the stated jurisdiction should then be checked for a matching entity, and for any licence if financial or exchange services are later advertised. Official project announcements, social profiles, or documentation from a source independent of this domain should link back to it. Without that link, the domain should be treated as unaffiliated with any known project. Security teams should also re-test the domain after the placeholder is replaced, since its current content is not representative of any eventual service. Evidence:

• Homepage: no named operator, contact route, or product documentation exists to anchor verification.
• Registration record: ownership details are hidden, so entity confirmation must come from the claimed operator directly.
• Archive history: the recent re-registration means earlier content cannot be attributed to the current holder.

Summary Verdict

Available evidence supports an elevated-risk posture. Independent threat detections and interaction-dependent behavior outweigh the site's technically sound basics, and the real-world operator remains unidentified. The site cannot be regarded as legitimate in its current state.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and WAF, and all observed addresses are edge servers, with the origin host not observable. A valid TLS certificate is in place. This is a mitigating factor only, because shared edge infrastructure is available to any customer and says nothing about the operator's legitimacy. It also prevents independent verification of the true hosting location and allows content to be swapped quickly behind the same address, which is relevant given the behavior observed on the homepage.

Closing Assessment

Interaction should be limited to passive, read-only viewing, if it is necessary at all. No login, credential entry, wallet connection, or payment should take place, and no software or files should be obtained from the domain until the operator is independently verified and the external detections are cleared.