Is dovu.live a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

The website at dovu.live is a recently registered domain whose only observable content was a security interstitial rather than a functioning product page. When the site was visited, the homepage returned an access-denied challenge from its CDN provider, headed with a suspected-phishing warning, and no products, services, pricing, or operator claims could be read. Its apparent purpose and business model therefore cannot be established from the site's own content, and it presents itself as an access-gated destination whose underlying offering is unknown.

Scam/Impersonation Risk

Contradictory signals are present and carry decisive weight. The domain is blacklisted: several independent security engines, including a major network-security vendor, currently flag it as malicious or suspicious. The phishing-suspicion interstitial shown on the homepage corroborates that listing. No brand impersonation or conflicting legal-entity names were observed, so the elevated assessment rests on reputation and behavior, not identity conflict. The domain's extreme youth sharpens the concern, because newly registered domains with active threat listings fit the disposable-campaign pattern used for phishing and credential-harvesting. Behavioral testing adds context: nearly all dynamic network activity went to external third-party hosts, the page generated many console errors, and the page structure was heavily rewritten after interaction. Testing found no wallet-drainer behavior, no clipboard manipulation, no hidden forms, and no credentials posted to external destinations, which slightly narrows the observed attack surface without offsetting the listing. Because the access challenge blocked content inspection, the absence of those behaviors is not proof of safety. Evidence:

• Homepage: the capture returned an HTTP 403 bot challenge titled "Suspected Phishing | Cloudflare".
• Domain registered 2026-08-11 (~0.21 years, roughly 76 days old), expiring 2027-08-11, through registrar NICENIC INTERNATIONAL GROUP CO., LIMITED.
• Homepage behavioral sandbox (3 successful runs): 69 external XHR/fetch calls, 9 external POST requests, 28 console errors, and 1,523 DOM mutations after interaction. Wallet-connect, clipboard-write, and hidden-form checks returned negative.

Regulatory Verification Notes

No legal, terms, privacy, about, or licensing pages could be captured, so the site's disclosure state is unclear and no regulatory status can be attributed to it. The registrant details are incomplete, which is ownership opacity: a limit on identifying the operator, not an identity contradiction. The real-world operator has not been independently connected to any brand or person. A valid certificate and mainstream hosting reflect baseline technical hygiene only. They do not establish legitimacy or any licensing standing. No third-party broker or regulator record matched this domain. Evidence:

• Hosting infrastructure: served from AS13335 (CLOUDFLARENET - Cloudflare, Inc., US).
• Transport encryption: TLS certificate issued by WE1 at DV (domain-validated) level, valid to 2027-01-08. DV validates domain control only, not organizational identity.
• Homepage: no operator name, registration number, or licence reference was visible on the captured content.

What to Verify Next

Before any engagement, the operator's claimed identity and any licence should be confirmed directly with the relevant registry or regulator, using details obtained independently and not from this domain. Any organization the site claims to represent should be contacted through its separately established official channels to confirm the domain is genuinely theirs. The threat listing and the phishing-suspicion warning should be re-checked after the owner has had time to respond, because a cleared listing and a fully loading site would materially change the picture. Evidence:

• Homepage: only a challenge page was observed, so there are no operator claims on the site to validate yet.
• External reputation: the malicious and suspicious detections were active when this analysis ran.

Summary Verdict

The overall posture is high-risk. Confirmed external threat detections, corroborated by a phishing-suspicion warning, outweigh the site's technical hygiene, and the operator has not been independently identified. Newness of the domain and the lack of inspectable content leave nothing in the evidence to counterbalance the reputational findings.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and WAF, and every observed address is a CDN edge node; the origin server could not be seen. This is a mitigating factor only, since protective infrastructure shields the host from attack but does not vouch for the operator. It also prevents independent verification of where the content is actually hosted, and it can conceal rapid content changes behind a stable edge.

Closing Assessment

The site should not be used for login, credential entry, wallet connection, or any payment or financial interaction. Any contact should be limited to passive viewing from an isolated environment, and no files should be downloaded. Reassessment is appropriate only if the threat listings are cleared and the operator's identity is independently confirmed.