Is novadex-dex.net a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

NovaDEX is a decentralized-exchange marketing and application front end that presents itself as "the #1 DEX on Solana". It offers token swaps, cross-chain bridging, concentrated-liquidity pools, SOL and NVX staking, a rewards and referral programme, and governance through a vote-escrowed NVX token. The apparent business model is a 0.04% swap fee plus liquidity-pool fees, which the site says go entirely to stakers and liquidity providers. Users are drawn in by advertised staking and pool yields, and part of those rewards is paid in the protocol's own NVX token.

Scam/Impersonation Risk

The site is blacklisted by external threat-intelligence sources. Several security engines independently flag the domain as malicious or suspicious, including at least one top-tier vendor, so this is a convergent external detection rather than a single outlier. No brand impersonation, conflicting legal identities or phishing-form behaviour was observed. The risk comes from the combination of the blacklisting, the site's own claims and the way the product asks users to commit funds. The homepage contradicts itself. It promises "no admin keys", "zero emissions inflation" and "no security incidents", yet its own text describes multi-signature upgrade governance and governance-voted NVX emissions. It supports its credibility with unverifiable superlatives and counters: $4.8B in total volume, $640M in locked value, 420K+ unique wallets, five named audits and a $10M bug bounty. It also claims "no MEV, no front-running" and "up to 10× more fees" from concentrated liquidity. No page links any of these figures to an independent source. Advertised staking and pool yields of 7.2% to 31.4% APY, with the top pool highlighted, are paired with token-emission rewards and referral payouts, a structure that depends on users depositing assets first. The page requests a wallet connection to enable swapping, which is the point at which a malicious front end could attempt to obtain transaction approvals. The sandbox did not observe wallet-draining or clipboard manipulation, but a blacklisted domain makes any approval prompt hazardous. Evidence:

• Homepage: the self-contradicting security and tokenomics claims (no admin keys and zero emissions against multi-signature governance and governance-voted emissions).
• Homepage: headline statistics and the audit and bug-bounty claims appear without verifiable links or proof.
• Domain provenance: registered 2026-07-30 (~0.22 years, about 78 days old), with 1 archive snapshot (2026-08-03) over 1 year tracked.
• The claimed multi-hundred-million-dollar locked value is not recognized in the DeFi protocol index.

Regulatory Verification Notes

The site names no legal entity, jurisdiction or postal address. It claims no licence or registration and does not tie the project to any identifiable operator. The application and documentation are split across two different domains, and the page offers no cross-verification that both belong to the same party. The five audits are cited by name but are not tied to checkable reports on the page beyond a footer link. Identity is therefore unverified. Nothing in the evidence connects the site to a real-world operator, and this cannot be treated as established legitimacy. No third-party broker or regulator record matched this site, so no reputational context is available from that route. The domain was registered through a low-profile registrar, with a generic administrator as registrant, and sits on a DV-only certificate. These are consistent with a newly stood-up site but give no assurance about who runs it. Evidence:

• Homepage and footer: no company name, jurisdiction, licence or address disclosed; the audit link is unaccompanied by any named auditor-hosted report.
• Domain registration: registrar Atak Domain, expiring 2027-07-30, with the registrant shown only as "Domain Administrator".
• Hosting: served from AS59692 (IQWeb FZ-LLC, UAE).
• Transport security: TLS certificate issued by YR1 (DV), valid to 2026-10-28, with only days remaining.

What to Verify Next

Any engagement should begin with independent confirmation of whether the project exists apart from this site. That means locating the protocol through established DeFi aggregators, the audit firms' own published reports, and the bug-bounty platform's own listing, none of which should be reached through links on this site. The on-chain program addresses and NVX token contract should be compared with those published by independent explorers and the audit reports. The relationship between the app domain and the separate documentation domain should be confirmed through an official channel not supplied by this site. Official support and social accounts should be confirmed by an independent route. Evidence:

• Homepage: five audits and a $10M bug bounty are asserted without named, verifiable reports.
• Link structure: only two external destinations, the app domain and a separate documentation domain.
• Homepage: the NVX token and the staked-SOL derivative are presented without contract identifiers.

Summary Verdict

The overall posture is high risk. External threat detections outweigh the polished interface, rich content and clean sandbox behaviour, and the site's self-contradicting claims and unverified identity reinforce that conclusion. The available evidence does not support treating this site as legitimate.

Infrastructure Integrity

The site sits on a single IP address at a UAE-based hosting provider, with no CDN or WAF in front of it, so the origin server is directly exposed and there is no protective layer to mitigate that. Abuse reports have been filed against that hosting IP. They apply to shared provider infrastructure rather than specifically to this domain, but they have not been discounted and add to the cautionary picture. The mismatch between the UAE hosting location and the European registry allocation, together with the sparse subdomain footprint typical of a young domain, are unconfirmed heuristics and carry little weight. The valid certificate and an identified network origin are baseline hygiene and do not offset the external threat detections.

Closing Assessment

The site should be treated as read-only at most. Wallets should not be connected, no transaction should be signed, no funds should be staked or deposited, and no credentials should be entered until the threat listings are cleared and the project's existence is confirmed through independent sources.

Signals weighed against the site

• AbuseIPDB: 5 reports on hosting IP 186.2.175.35 (IQWeb FZ-LLC, Data Center/Web Hosting/Transit), 12% confidence. The reports are attributed to shared infrastructure, not specifically to this website.