Verdict
divar.ir is moderately trusted.
Most signals looked ordinary, and some evidence was missing. Read the checks below before you pay or hand over personal details.
This site blocks TrustSniffer's automated capture, so the page itself was read through a visitor's browser (with private details removed there). Every other check ran on TrustSniffer's servers, and the score is limited to what those checks support.
| What this site appears to be | Persian-language classifieds listing for a rental property in Mashhad with deposit and monthly rent, property features, and contact/viewing instructions. Standard marketplace content without payment flows on-page. |
|---|
Evidence status and limitations
Evidence completeness: UNKNOWN
- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.
At a glance
The checks that decide most of this verdict.
| Malware engines | None flagged itVirusTotal | Clear |
|---|---|---|
| Google Safe Browsing | Not listedGoogle | Clear |
| Abuse reports on the host | 11% confidenceAbuseIPDB, 10 reports; shared hosting inflates reports | Clear |
| Domain age | Not availableNo registration record was returned | Noted |
| Web archive | Archived since 2007Public history exists | Clear |
| Certificate | Encrypted connectionIssued by Certum DV TLS G2 R39 CA | Noted |
The page as captured
No screenshot is retained for this report.
Key findings
- Automated classification: Not Scam.
- Public web-archive history exists since 2007.
- VirusTotal and Google Safe Browsing had no flags for this domain; its hosting IP carries AbuseIPDB reports below the confidence level TrustSniffer treats as a flag.
- The operator behind the site could not be independently connected to a real-world brand or person.
Full analysis
Overview
The website is Divar, a Persian-language classifieds marketplace presenting user-posted listings across categories, including a Mashhad apartment rental with deposit, monthly rent, property features, and instructions for arranging contact or viewing; its apparent business model is to connect buyers, renters, sellers, and landlords rather than custodially process transactions on the listing page.
Scam/Impersonation Risk
No contradictions were observed. The reviewed listing has no phishing indicators, login form, hidden form, sensitive-data request, or suspicious external destination, and its content is consistent with an ordinary marketplace advertisement. The listing provides specific property information and identifies the platform’s standard contact, chat, reporting, and transaction-warning functions; this supports an apparently authentic marketplace use case, while the identity of the individual landlord remains a separate matter requiring normal counterparty checks.
- The property page presents a Mashhad rental listing with stated deposit, monthly rent, size, floor, amenities, and viewing instructions.
- The property page contains no login form, sensitive form, hidden form, or untrusted destination.
- The page includes standard marketplace functions such as contact information, chat, reporting, and pre-transaction warnings.
- External checks recorded no blacklist or malicious-site finding, while the platform has a top-tier global traffic footprint.
Regulatory Verification Notes
The available evidence supports a moderate-trust, apparently established marketplace rather than a confirmed scam or impersonation site. The reviewed content does not present a licensing claim or license number; for a classifieds platform that facilitates introductions rather than holding transaction funds, this is a transparency and consumer-protection question rather than evidence of fraud. Real-world operator identity is not independently verified, so the site’s apparent legitimacy should not be treated as proof of a particular legal entity. A soft reputational signal exists because the shared hosting provider’s IP infrastructure has received abuse reports; the signal is attributed to shared infrastructure rather than specifically to the website. The absence of a matched broker-reputation record provides contextual support but is not a legal or regulatory determination.
- The site is served through AS202319, identified as Sotoon-CDN - Hezardastan Unit Cloud Computing PJSC, IR.
- The site’s TLS certificate is issued by Certum DV TLS G2 R39 CA, uses DV validation, and is valid to 2026-12-01T12:32:17+00:00.
- The shared provider IP record contains 10 abuse reports with a confidence score of 11; the attribution identifies shared infrastructure and Content Delivery Network usage.
- The reviewed marketplace content contains no license claim or license number.
What to Verify Next
Before a high-value rental commitment, the prospective counterparty should be verified independently through the property, landlord, and viewing details rather than relying solely on the listing. Any deposit or advance payment should use a documented, traceable method with appropriate payment protection, and the platform’s official support and dispute channels should be confirmed through its own pages or an independently obtained contact route. Where a transaction or service falls within a regulated or locally licensed activity, the relevant registry and the platform’s applicable legal entity should be checked before funds are transferred.
- The property page states that the displayed images are illustrative rather than necessarily depicting the exact property.
- The property page provides separate deposit and monthly-rent amounts and directs the applicant to arrange viewing and further explanation.
- The page exposes reporting and support functions that can be used to document a disputed or misleading listing.
- The reviewed page is informational and does not itself provide a payment flow.
Summary Verdict
The website presents a moderate-trust posture with no observed scam, phishing, blacklist, or impersonation contradiction. Available evidence is consistent with an established, apparently legitimate classifieds service, but independent operator and counterparty verification remain incomplete, making the posture appropriate for ordinary marketplace use with added care around consequential commitments.
Infrastructure Integrity
The site resolves through infrastructure without a detected CDN edge or WAF layer, with four likely origin addresses identified. This increases direct infrastructure exposure relative to an edge-protected deployment, but it is a technical characteristic rather than evidence that the website is malicious; the valid transport certificate remains a mitigating control.
- Infrastructure resolution identified 4 unique IP addresses and 4 likely origin addresses.
- The deployment reported 0 edge IP addresses and no detected CDN.
- The resolved infrastructure is registered through RIPE NCC and located in Iran.
Correction: the hosting record for this site names Sotoon-CDN, a content delivery network that TrustSniffer now recognises. The statement above that no CDN edge was detected was written before that recognition and does not reflect it. A new analysis restates it from the corrected infrastructure check.
Closing Assessment
Ordinary browsing and evaluation of listings are proportionate, while deposits, identity documents, and other high-value commitments should proceed only after the relevant parties and payment arrangements have been independently confirmed.
Written analysis generated 2026-09-28 by the TrustSniffer Analysis Engine from the evidence in this report.
What the analysis found
1 finding contributed to this verdict, raised by registration and ownership.
01 Governance Risk
- The public registration record for this domain is incomplete.Registration and ownership
rule:KF_WHOIS_INCOMPLETE
Signals weighed against the site
- AbuseIPDB: 10 reports on hosting IP 185.166.104.7 (Avaye Hamrahe Houshmande Hezardastan PJSC, Content Delivery Network), 11% confidence. The reports are attributed to shared infrastructure, not specifically to this website.
Identity verification
| Status | UNVERIFIED |
|---|---|
| Identity score | 30/100 |
| Identity verification confidence | 50% |
- No on-site identity signals detected
Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence.
What TrustSniffer observed
First-party facts recorded during the assessment of divar.ir.
- The request stayed on divar.ir. It was not redirected to another domain. Clear
- DNS for this domain is served by sotoon53.com, across 2 name servers. Noted
- The earliest public archive of this site is from 2007-02-18. Clear
- It is hosted on Sotoon-CDN, from a server in IR. Noted
Domain intelligence
| Registrar | Not available |
|---|---|
| Hosting | Sotoon-CDN - Hezardastan Unit Cloud Computing PJSC, IR |
| Country | IR |
| Server IP | 185.166.104.7 |
| Name servers | ns.sotoon53.com, d.ns.sotoon53.com |
| SSL issuer | Certum DV TLS G2 R39 CA |
| SSL expiry | 2026-12-01 |
| Domain age | Not available (no registration date was returned) |
| Domain expiry | Not available |
| Archive first seen | 2007-02-18 |
| Archive snapshots | Not counted (archive lookup incomplete) |
| Reputation | VirusTotal: 0 flagged | AbuseIPDB: 11% confidence, 10 reports | Google Safe Browsing: 0 matches |
About this assessment
A trust score summarises the evidence TrustSniffer could collect about divar.ir at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.
TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.