Is qwblock.com a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a single-page, JavaScript-dependent crypto account dashboard titled "BTC Pledge". It shows a custodial-style interface with a user ID, a "Total Asset Valuation" balance in USDT, and Deposit, Withdraw, Convert and Quick Trade controls. Below these sits a live price board of USDT pairs, including BTC, ETH, SOL, XRP, BNB and wrapped tokens. Its apparent business model is a custodial pledge-and-trading service in which users place crypto assets with the operator, but the page does not say how the pledge generates returns.

Scam/Impersonation Risk

Contradictory signals are present, so this is a clearly cautionary assessment. The domain is confirmed as blacklisted by independent external reputation sources. Several engines in a multi-engine reputation scan classify it as malicious, and one top-tier security vendor flags it. No brand impersonation, conflicting legal identities or credential-harvesting forms were detected. The risk therefore comes from the external detections combined with the business model, not from a copied brand. The homepage offers deposit, withdrawal, conversion and quick-trade functions around a "BTC Pledge" product. It gives no legal entity, no pledge terms, no yield mechanism, no fee schedule and no named counterparty holding the funds. The ticker looks professional (for example BTC/USDT near 81,750 and fifteen listed tokens), but this is not evidence of a real trading venue. Funds would pass into an account controlled by an unidentified operator before any service is delivered. That pattern is typical of deposit-first pledge and staking schemes, where balances display normally until withdrawal is attempted. The page also shows a "JavaScript required" notice and carries no meta description or structured data. This is consistent with a thin front end rather than an established product. Evidence:

• Homepage: the page presents the "BTC Pledge" title with Deposit, Withdraw, Convert and Quick Trade controls, and no explanation of how pledge returns are produced.
• Homepage: the page lists fifteen tokens against USDT, which gives the appearance of market depth without any identified exchange or custodian.
• External reputation: 3 engines rate the domain malicious and 1 suspicious, including a tier-one vendor, and an external blacklist flag is set.
• Domain history: only 3 archive snapshots exist, spanning 2019–2022 (4 years tracked). These captures predate the current registration and show no continuous operating record.

Regulatory Verification Notes

The site discloses no legal entity, licence, registration number, regulator, physical address or contact channel on the page analysed. For a service that holds user funds and offers a yield-style product, this is a serious disclosure gap and not a minor omission. It is a verification failure that compounds the reputational detections, and it cannot be treated as a neutral administrative detail. Registrant details are also incomplete, so no real-world operator can be tied to the site. The operator's identity remains unverified, and no third-party broker or regulatory listing matches the domain. The site's transport encryption is valid, but a basic domain-validated certificate says nothing about who operates the service or whether it is lawful. Evidence:

• Homepage: no company name, licence, regulator, address or contact detail appears anywhere in the captured content.
• Domain registration: registered 2026-09-05 through Gransy, s.r.o., about 0.12 years (~44 days) old, expiring 2027-09-05.
• Transport security: the TLS certificate was issued by WE1 (domain-validated only) and is valid to 2026-12-04.
• Hosting: served from AS13335 (Cloudflare, Inc., US).

What to Verify Next

No deposit should be considered unless the operating entity is identified and its authorisation to hold customer crypto assets is confirmed with the relevant financial regulator or virtual-asset registry. The operator should be asked to name the counterparty that holds pledged assets, the source of any advertised return, and the withdrawal terms. Official support channels should be confirmed through an independent route and not through links on the site. Independent sources should be checked for reports from other users about withdrawal problems on this domain, particularly since the domain was registered only recently. Evidence:

• Homepage: no pledge terms, fee schedule or risk disclosure are published to check against.
• Domain registration: the registration is about 44 days old, so any claim of long operating history can be tested against this date.
• External reputation: the detections should be re-checked on current threat-intelligence sources before any decision is made.

Summary Verdict

The authoritative assessment is critical-risk, with a clearly cautionary posture. Independent threat detections, a deposit-first custodial model with no verifiable operator, and a very recent registration all point the same way. The technically clean presentation (valid encryption, quiet browser behaviour, no external calls) does not offset this, because it shows only that the page loads without errors and says nothing about the operator.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and WAF, and every observed address is a CDN edge node, so the origin server cannot be seen. This mitigates direct exposure to attack, but it also prevents independent verification of where the service is actually hosted. It is a mitigating factor only and does not support legitimacy. A sparse subdomain footprint on a very young domain is an unconfirmed heuristic flag and is not treated as a confirmed risk.

Closing Assessment

Treat the site as unsafe for any financial interaction. No funds, assets, credentials or personal data should be provided, and observation of the public page should be the limit of use. Anyone who has already deposited should stop further transfers, keep transaction records, and consider reporting the case to their exchange and to the relevant consumer-protection or cybercrime authority.