--- title: "Is downtofinance.org a Scam? Trust Score 0/100" source: TrustSniffer type: Website trust & fraud report subject: "downtofinance.org" verdict: "Critical Risk" title: "Is downtofinance.org a Scam? Risk Report, Score 0/100" trust_score: 0 classification_confidence: 70 canonical_url: https://trustsniffer.com/report/downtofinance.org assessed: 2026-10-22 --- # Is downtofinance.org a scam? TrustSniffer's high-risk assessment: 0/100 ## Verdict **Verdict: Critical Risk, trust score 0/100.** downtofinance.org shows high-risk / scam indicators. This assessment found strong scam indicators. Do not pay, sign in, or share personal details with this site. Labels: Sensitive Interaction Risk, Governance Risk Assessed 2026-10-22 by automated analysis. Classification confidence 70%. ## Evidence status and limitations Evidence completeness: Not recorded - The real-world operator identity was not independently verified. - Module-level completeness metadata is unavailable for this legacy report. ## At a glance The checks that decide most of this verdict. | Check | Result | Status | | --- | --- | --- | | Malware engines | 4 flagged it (VirusTotal) | Risk | | Google Safe Browsing | Not listed (Google) | Clear | | Abuse reports on the host | 73% confidence (AbuseIPDB, 205 reports; shared hosting inflates reports) | Risk | | Domain age | 1 months old (Most scam domains are under a year old) | Risk | | Web archive | Archived since 2026 (2 snapshots) | Clear | | Certificate | Encrypted connection (Issued by YR1) | Noted | ## The page as captured ![Screenshot of the downtofinance.org homepage captured during the TrustSniffer assessment](https://trustsniffer.com/outputs/downtofinance.org/screenshots/first.png) _What downtofinance.org served when TrustSniffer captured it on 2026-10-22. The page may look different now._ ## Key findings - Automated classification: Sensitive Interaction Risk. - Domain age: less than 1 year (registration continuity). - Public web-archive history exists since 2026. - At least one reputation service TrustSniffer consulted had flagged this domain at assessment time. ## Full analysis ### Overview This is a very recently registered .org website whose homepage carries the title "Google", even though its domain name points to a finance theme. The page is thin, with roughly three thousand characters of text, and it states no clear product, service, or business model. As a result, the site's apparent purpose cannot be established from its own content. Its stated brand label does not match its domain, and the operator's real-world identity is not independently connected to any known organization. ### Scam/Impersonation Risk This site carries **elevated, confirmed threat-reputation contradictions**. Multiple independent threat-intelligence sources currently flag the domain as malicious, and a consolidated external check also reports it as blacklisted. Together these amount to a confirmed blacklist condition, which is the decisive factor in this assessment. A separate reputation signal comes from the shared hosting address the site resolves to. Hundreds of abuse reports, filed by a broad base of distinct reporters, concern an address operated by a major code-hosting provider's content-delivery service. Because that address is shared infrastructure, those reports cannot be pinned on this site alone. They are not discounted, however, and they reinforce the cautionary picture. The homepage title presents the site as "Google", a mismatch with a finance-named domain that is characteristic of brand-borrowing lookalikes. No conflicting legal entities were found, and impersonation is not confirmed on the available evidence. Sandbox behavior was comparatively benign: no wallet-connection prompts, clipboard tampering, hidden forms, credential posts to outside parties, or cloaking were observed. The page did run several suspicious inline scripts, and most of its network traffic goes to third-party origins. All of that traffic was directed to recognized destinations. Evidence: - Homepage: titled "Google" while served from a finance-themed .org domain, with sparse body text and no stated offering. - Domain provenance: registered 2026-09-06 (~0.12 years old, ~45 days) through Namecheap, expiring 2027-09-06. - Web archive: only 2 snapshots, between 2026-09-17 and 2026-09-22 (1 year tracked), so there is no meaningful history. - Reputation: 4 threat-intelligence engines rated the domain malicious and 1 suspicious; the shared edge address carries 205 abuse reports from 33 distinct reporters. - Homepage behavior: 3 suspicious inline scripts, 38 external XHR requests and 14 external POSTs, all to whitelisted destinations. ### Regulatory Verification Notes The site gives no discernible legal or identity disclosures. No operating company, licensing status, registration number, or jurisdiction is stated on the captured homepage, and no regulated-entity match was found. No broker-reputation match exists either. This is a verification gap, not independent evidence of wrongdoing. Here it compounds the threat-reputation findings, because no verifiable operator stands behind the domain. Identity has not been independently verified, so any on-page claim should not be treated as proof of who runs the site. The site's technical hygiene is basic: it presents a valid domain-validated certificate with subject alternative names, which confirms encrypted transport only and says nothing about the operator's legitimacy. Evidence: - Homepage: no company name, license, or registration number appears in the captured content. - Transport encryption: TLS certificate issued by YR1 (DV, domain-validated only), valid to 2026-12-05 with 43 days remaining. - Hosting: served from AS54113 (FASTLY - Fastly, Inc., US), registry RIPE NCC, country US. ### What to Verify Next Any prospective interaction should start by establishing who operates this domain through independent, offline channels. The "Google" title must not be taken as evidence of any affiliation with that company, and any claimed link should be confirmed only from that organization's own known, directly typed official address. If the operator claims to offer financial services, their licensing should be checked directly in the relevant regulator's public registry. The domain's current threat listings should also be re-checked after the operator has had a chance to respond. A domain this new with this reputation should not be relied on until the flags clear. Evidence: - Homepage: no operator name or regulatory reference is available to cross-check against a registry. - Domain age: the roughly 45-day-old registration gives no track record to rely on. - Reputation: the blacklist and abuse-report findings above remain unresolved. ### Summary Verdict The overall posture is **critical and clearly cautionary**. Confirmed blacklist-level threat detections, a very young domain with no meaningful history, and an unverified operator behind a mismatched brand label converge on a high-risk conclusion. The benign sandbox behavior and the valid certificate do not offset the external threat detections. ### Infrastructure Integrity The site is delivered through the Fastly content-delivery and edge-protection network. All four observed addresses are edge nodes, and no origin server was observable. Edge-only visibility mildly mitigates direct exposure of the host, but it also prevents independent hosting verification and can mask rapid content changes. It is a mitigating factor only and does not offset the reputation risk. Because the edge addresses are shared with other tenants, the abuse reports tied to them cannot be attributed to this site with certainty. ### Closing Assessment At most, the site should be viewed read-only. No login, credential entry, or financial interaction should take place, and nothing should be downloaded from it. Anyone who has already interacted with it should treat any credentials or payment details they submitted as exposed. They should change those credentials and watch the affected accounts for unusual activity. _Written analysis generated 2026-10-22 by the TrustSniffer Analysis Engine from the evidence in this report._ ## What the analysis found 4 findings contributed to this verdict, raised by external reputation, hosting and network, behaviour in a sandbox, history in the web archive. ### 01 External reputation - An external threat feed lists this domain: either Google Safe Browsing marked it malicious, or a significant number of malware engines flagged it. (External reputation `rule:EXT_BLACKLIST_CRITICAL`) - The server address behind this site has a strong record of abuse reports. (External reputation `rule:EXT_ABUSEIP_SEVERE`) ### 02 Hosting and network - The domain was registered less than three months ago. (Hosting and network `rule:DNS_NEW_DOMAIN_90D`) ### 03 Behaviour in a sandbox - The page carried inline scripts written in a style TrustSniffer treats as suspicious. (Behaviour in a sandbox `rule:BEHAV_SUSPICIOUS_INLINE_SCRIPTS`) - Most of what the page loaded came from other domains rather than from this one. (Behaviour in a sandbox `rule:BEHAV_EXTERNAL_RATIO_HIGH`) ### 04 History in the web archive - The web archive has almost no record of this domain, which fits a site that is new. (History in the web archive `rule:ARCH_PEN_YOUNG_AND_SPARSE`) ### Signals weighed against the site - AbuseIPDB: 205 reports on hosting IP 185.199.108.153 (GitHub, Inc., Content Delivery Network), 73% confidence. The reports are attributed to shared infrastructure, not specifically to this website. ## Identity verification | Field | Value | | --- | --- | | Status | UNKNOWN | | Identity score | 50/100 | | Identity verification confidence | 15% | - AI page analysis unavailable (page captured; identity not AI-verified) _Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence._ ## What TrustSniffer observed First-party facts recorded during the assessment of downtofinance.org. - The request for downtofinance.org ended on www.google.com, a different domain. (Watch) - Registration is published under NAMECHEAP INC. (Clear) - DNS for this domain is served by registrar-servers.com, across 2 name servers. (Noted) - The registration is paid up to 2027-09-06. (Noted) - The earliest public archive of this site is from 2026-09-17. (Clear) - It is hosted on FASTLY, from a server in US. (Noted) ## Domain intelligence | Field | Value | | --- | --- | | Registrar | NAMECHEAP INC | | Hosting | FASTLY - Fastly, Inc., US | | Country | US | | Server IP | 185.199.108.153 | | Name servers | dns1.registrar-servers.com, dns2.registrar-servers.com | | CDN / edge network | Detected (fastly) | | Resolved IP addresses | 4 | | Edge IP addresses | 4 | | Likely origin IP addresses | 0 | | SSL issuer | YR1 | | SSL expiry | 2026-12-05 | | Domain age | 0.12 years (continuous registration) | | Domain expiry | 2027-09-06 | | Archive first seen | 2026-09-17 | | Archive snapshots | 2 | | Reputation | VirusTotal: 4 flagged \| AbuseIPDB: 73% confidence, 205 reports \| Google Safe Browsing: 0 matches | ## About this assessment **Was this report useful?** Tell other people what you think of TrustSniffer, good or bad. An honest review helps others decide whether to rely on these checks. [Review TrustSniffer on Trustpilot](https://www.trustpilot.com/review/trustsniffer.com) A trust score summarises the evidence TrustSniffer could collect about downtofinance.org at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present. TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed. ## Related on TrustSniffer - [connectmodalsol.org](https://trustsniffer.com/report/connectmodalsol.org), another .org site assessed as critical-risk (Critical Risk, 0/100) - [senttobnb.org](https://trustsniffer.com/report/senttobnb.org), another .org site assessed as critical-risk (Critical Risk, 5/100) - [sinport.org](https://trustsniffer.com/report/sinport.org), another .org site assessed as critical-risk (Critical Risk, 0/100) - [rpsrescue.org](https://trustsniffer.com/report/rpsrescue.org), another .org site assessed as critical-risk (Critical Risk, 0/100) - [catevent.org](https://trustsniffer.com/report/catevent.org), another .org site assessed as critical-risk (Critical Risk, 0/100) - [adstart.org](https://trustsniffer.com/report/adstart.org), another .org site assessed as critical-risk (Critical Risk, 11/100) - [hifibridge.org](https://trustsniffer.com/report/hifibridge.org), another .org site assessed as critical-risk (Critical Risk, 0/100) - [blaze-stake.org](https://trustsniffer.com/report/blaze-stake.org), another .org site assessed as critical-risk (Critical Risk, 0/100) - [wqerweq.pages.dev](https://trustsniffer.com/report/wqerweq.pages.dev), another site assessed as critical-risk (Critical Risk, 0/100) - [bankdefi.finance](https://trustsniffer.com/report/bankdefi.finance), another site assessed as critical-risk (Critical Risk, 0/100) - [Every website and wallet TrustSniffer has assessed](https://trustsniffer.com/directory), the full risk directory - [Other domains assessed as high-risk or phishing](https://trustsniffer.com/directory/phishing-domains), same verdict band - [Check another website](https://trustsniffer.com/web-intelligence), run a new assessment - [Check a crypto wallet address](https://trustsniffer.com/on-chain-risk), on-chain screening - [The TrustSniffer Risk Index](https://trustsniffer.com/stats), how this verdict compares ## Guides - [Crypto Scam Websites in 2026: What a List Misses](https://trustsniffer.com/blog/crypto-scam-websites-2026-what-a-list-misses) - [Stablecoin Freezes, Oct 23, 2026: 8 Wallets](https://trustsniffer.com/blog/stablecoin-freeze-report-2026-10-23) - [How to check if TRC20 USDT is genuine Tether](https://trustsniffer.com/blog/how-to-check-if-trc20-usdt-is-genuine-tether) --- *Source: [TrustSniffer](https://trustsniffer.com/report/downtofinance.org) — independent automated trust & fraud analysis. Cite as https://trustsniffer.com/report/downtofinance.org · assessed 2026-10-22.*