Is just-swap.net a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

JustSwap is a single-page decentralized-finance web application that presents itself as a non-custodial exchange on the TRON network. It offers token swaps, liquidity pools, TRX staking and collateralized borrowing, and invites visitors to connect a crypto wallet and sign transactions. Its apparent business model is an automated-market-maker exchange. The page says the swap fee goes to liquidity providers, so it discloses no direct operator revenue.

Scam/Impersonation Risk

Contradictory signals are present, and the posture is clearly cautionary. Several independent security engines currently flag the domain as malicious or suspicious, including two tier-one engines, and the domain is treated as blacklisted. Infrastructure protections cannot offset this. No brand impersonation or conflicting legal identities were detected, so the concern is the external threat listing combined with a weak claim-to-proof ratio on the homepage. The page advertises a $1.2B total value locked and "zero incidents" as live facts. It also advertises staking yields of up to 4.2% annualized, liquidity-pool APYs of 3% to 15%, and collateralized borrowing at 8.5% APR. Yet it says the smart contract addresses "will be published before mainnet launch", so the headline figures cannot be tied to any on-chain contract. CertiK, PeckShield and Hacken are named as auditors without linked reports, and the wallet-signing flow is pre-populated with "Transaction signed" and "Signature Confirmed" status text before any wallet is connected. Browser sandbox runs also recorded heavy third-party traffic, with roughly three-quarters of requests going to external hosts and a share of the external POST and XHR calls going to non-whitelisted destinations. The domain is not recognized in public DeFi analytics listings, which leaves the headline value claim uncorroborated. The domain's provenance also fails: archive captures begin years before the current registration. Evidence:

• Homepage: states $1.2B TVL and "zero incidents" as mainnet facts, while stating that contract addresses will be published before launch.
• Homepage: advertises up to 4.2% staking, 3%–15% LP APYs and 8.5% APR borrowing; names three audit firms with no linked reports.
• Registration: current registration created 2026-07-30 (~0.22 years old), yet 3 archive snapshots span 2021–2026 (6 years tracked, first seen 2021-12-06) with a gap of about five years.
• Threat intelligence: 11 malicious and 2 suspicious detections across the engines queried, with 2 tier-one engines among them.

Regulatory Verification Notes

The site names no operating company, registered address, licence or regulator anywhere on the page, and no legal or terms pages were evidenced. Its only assurance is a FAQ answer saying "We never have access to your funds", which is a self-description and not proof of anything. For a service that asks users to sign transactions and deposit assets, this is a material disclosure gap. The registrant record shows only a generic administrator label and a placeholder organization, so the operator cannot be tied to a real-world person or company. No third-party broker or regulatory listing matched the site, and no licence is claimed. Evidence:

• Homepage and FAQ: no legal entity, physical address or licence disclosure; the only security statement is the self-custody FAQ answer.
• Registrar: Atak Domain, registrant shown as "Domain Administrator" for "Registrant of just-swap.net".
• Transport encryption: DV certificate issued by WE1, valid to 2026-12-26 (66 days remaining), which proves only that the connection is encrypted.
• Hosting: served from AS13335 (Cloudflare, Inc., US).

What to Verify Next

Verification only matters if a genuine project operates behind this domain, and it should be done independently of anything the site links to. Contract addresses, if any exist, should be located through the official channels of the real project and checked on a public TRON block explorer. Audit reports should be retrieved directly from the named audit firms and matched to the exact contracts. The claimed TVL should be checked against an independent DeFi analytics source. Support and contact channels should be confirmed through an independent route. Evidence:

• Homepage: audit firms named without linked reports, so the claims cannot be matched to deployed code.
• Homepage: the pre-launch contract-address statement leaves no on-chain target to inspect.
• Homepage: no operator identity is given to check against any registry.

Summary Verdict

The available evidence points to a high-risk site. Active threat-intelligence listings, an unproven and internally inconsistent set of security and performance claims, and a registration that does not match the site's archive history converge on a critical risk assessment. Operator identity is unverified. The site's technical polish does not change that posture.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and WAF, and all observed addresses are edge servers. The origin server was not observable, which prevents independent verification of the hosting behind the edge. A valid certificate and mainstream infrastructure are mitigating factors only, not evidence of legitimacy, and they do not outweigh the threat listings. A young domain with sparse DNS structure was noted as an unconfirmed heuristic.

Closing Assessment

Wallet connection, transaction signing and any deposit, staking or borrowing should be avoided on this domain. At most, the page should be viewed read-only, with no credentials entered. Anyone seeking the genuine project should navigate from an independently verified official source.