Verdict
This assessment found strong scam indicators. Do not pay, sign in, or share personal details with this site.
qudefi-ia.pages.dev shows high-risk / scam indicators.
Evidence status and limitations
Evidence completeness: Not recorded
- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.
At a glance
The checks that decide most of this verdict.
| Malware engines | 13 flagged itVirusTotal | Risk |
|---|---|---|
| Google Safe Browsing | Not listedGoogle | Clear |
| Abuse reports on the host | 0% confidenceAbuseIPDB, 0 reports; shared hosting inflates reports | Clear |
| Domain age | Not availableNo registration record was returned | Noted |
| Certificate | Encrypted connectionIssued by WE1 | Noted |
| Hosted by | CLOUDFLARENETServer in US | Noted |
The page as captured
Key findings
- Automated classification: Sensitive Interaction Risk.
- At least one reputation service TrustSniffer consulted had flagged this domain at assessment time.
Full analysis
Security Alert
Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.
QuDefi is a single-page website titled "QuDefi", published on a free subdomain of a shared web-hosting platform rather than on a dedicated branded domain. The name and presentation suggest a decentralized-finance themed service. Its homepage carries a substantial amount of text, but the real-world operator and the exact business model could not be tied to any identifiable company or person.
Scam/Impersonation Risk
Contradictory signals are present and decisive. Several independent threat-intelligence engines currently classify the site as malicious, and a consistent group of them also flags it as suspicious. This includes three tier-one security vendors, and the detection volume is high enough to trigger a confirmed blacklist condition. This is a reputational finding about the site itself. Hosting on a shared platform subdomain also puts the site in the same class as throwaway or disposable deployments, which are common vehicles for phishing and credential-harvesting pages. A DeFi-style brand on such a subdomain is a recognised high-risk pattern, since the name borrows the credibility of crypto-finance services without any independent anchor. The behavioural sandbox did not observe wallet-connection prompts, clipboard tampering, hidden forms, cloaking or credential posts to external hosts, so no active drainer mechanics were captured. That absence does not offset the external detections, because malicious content can be served selectively or changed after the observation window. No conflicting legal identities or confirmed brand impersonation were identified. The risk rests on the blacklist evidence and the high-risk deployment pattern.
- Homepage and hosting layer: multiple security engines currently flag the site, with 13 malicious and 2 suspicious verdicts across the engines consulted. Fortinet, Kaspersky and Sophos are among the flagging vendors.
- Homepage behaviour: three sandbox runs completed, with 74 external background requests, all to allow-listed destinations. 24 browser console errors were logged and no cloaking was detected.
- Site address: the site is served from a shared-platform subdomain, and its name closely resembles the parent platform's own domain.
Regulatory Verification Notes
The homepage is the only captured page. No legal, terms, privacy or about content that would name a legal entity, a jurisdiction, a licence or a registration number was available to assess, and the on-page disclosure position remains unclear. For a site presenting a finance-themed identity, that absence leaves nothing to support the brand. It is a disclosure gap, and it does not by itself indicate fraud. Identity could not be tied to any real-world brand or person, so any legitimacy claim by the site must be treated as unsupported. No third-party broker or regulator listing matched the site, which is neutral. The transport layer is technically sound, but a basic domain-validated certificate only confirms control of the hostname and says nothing about who operates it.
- Homepage: the page was captured successfully, but no named operating entity, licence or registration reference was found in it.
- Transport encryption: TLS certificate issued by WE1 (DV), valid to 2026-12-23, about 55 days remaining at the time of analysis.
- Hosting: served from AS13335 (Cloudflare, Inc., US).
What to Verify Next
Treat the site as unverified until an independent route establishes who runs it. Any claimed brand should be checked against its officially published website, reached through a trusted search or a known bookmark and not through this address. Any claimed regulated activity should be checked against the relevant financial regulator's public register. Support and contact channels should be confirmed through an independent, offline route. Any link to this site that arrived by message, advertisement or social media should be traced back to its origin.
- Homepage: the site presents a DeFi-style identity under a shared-platform address, so brand ownership should be confirmed against the official project channels.
- Homepage: no regulator or licence reference is displayed, so none can be checked from the page itself.
- Reputation: the site's current malicious classification should be rechecked against threat-intelligence sources before any further interaction.
Summary Verdict
The site sits in a critical-risk posture. Active detections by multiple independent security sources, together with an unverified operator identity and a high-risk deployment pattern, outweigh the technically valid but low-assurance encryption. Available evidence does not support treating it as a legitimate service.
Infrastructure Integrity
The site is delivered through Cloudflare's CDN and web application firewall. All four observed addresses are CDN edge servers, and the origin server was not observable, so the real hosting location cannot be independently confirmed. This protection is a mitigating factor for availability and basic abuse resistance. It does not offset the reputation findings. The edge-only view also means content could be swapped quickly without any change in the visible network footprint.
Closing Assessment
The site should be avoided for any login, credential entry, wallet connection or financial transaction. Any necessary visit should be limited to read-only viewing from an isolated environment, and nothing should be downloaded from it.
Written analysis generated 2026-10-29 by the TrustSniffer Analysis Engine from the evidence in this report.
What the analysis found
3 findings contributed to this verdict, raised by external reputation, registration and ownership, behaviour in a sandbox.
01 External reputation
- An external threat feed lists this domain: either Google Safe Browsing marked it malicious, or a significant number of malware engines flagged it.External reputation
rule:EXT_BLACKLIST_CRITICAL
02 Registration and ownership
- The public registration record for this domain is incomplete.Registration and ownership
rule:KF_WHOIS_INCOMPLETE
03 Behaviour in a sandbox
- The page produced an unusually high number of errors while it ran.Behaviour in a sandbox
rule:BEHAV_CONSOLE_ERRORS_HIGH - The page made many background requests to other domains while it was open.Behaviour in a sandbox
rule:BEHAV_EXTERNAL_XHR_HEAVY
Identity verification
| Status | UNKNOWN |
|---|---|
| Identity score | 50/100 |
| Identity verification confidence | 30% |
- AI page analysis unavailable (page captured; identity not AI-verified)
Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence.
What TrustSniffer observed
First-party facts recorded during the assessment of qudefi-ia.pages.dev.
- The request stayed on qudefi-ia.pages.dev. It was not redirected to another domain. Clear
- It is hosted on CLOUDFLARENET, from a server in US. Noted
Domain intelligence
| Registrar | Not available |
|---|---|
| Hosting | CLOUDFLARENET - Cloudflare, Inc., US |
| Country | US |
| Server IP | 2606:4700:310c::ac42:2fb0 |
| Name servers | Not available |
| CDN / edge network | Detected (cloudflare) |
| Resolved IP addresses | 4 |
| Edge IP addresses | 4 |
| Likely origin IP addresses | 0 |
| SSL issuer | WE1 |
| SSL expiry | 2026-12-23 |
| Domain age | Not available (no registration date was returned) |
| Domain expiry | Not available |
| Archive first seen | Not available |
| Archive snapshots | Not counted (archive lookup incomplete) |
| Reputation | VirusTotal: 13 flagged | AbuseIPDB: 0% confidence, 0 reports | Google Safe Browsing: 0 matches |
About this assessment
A trust score summarises the evidence TrustSniffer could collect about qudefi-ia.pages.dev at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.
TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.