Is scans-goednet.com a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a single-page presence titled as an informational page about GEODNET, a blockchain DePIN (decentralized physical infrastructure) project. Its title promises news, founding-team and investor details, and DePIN event coverage. It sits on a recently created domain whose name is a close variant of that project's name, and its apparent purpose is to present itself as a project-information or community resource.

Scam/Impersonation Risk

This is the decisive section of the assessment. Multiple independent threat-intelligence sources currently flag the domain as malicious or suspicious, including one major security vendor, and the combined external detections amount to a confirmed blacklist listing. Nothing on the site offsets this. The domain name is a near-variant of the project name shown in the homepage title, and the page claims to cover that project's founders and investors. That pattern fits a lookalike or brand-borrowing site, though the site's actual operator is not independently identified. No conflicting legal entities were found, but the external detections are enough on their own to make this a high-risk site for any sensitive interaction. In the behavioral sandbox the homepage made a very large volume of third-party requests. These included data submissions to external destinations outside the commonly recognized service set, some to unclassified endpoints. The sandbox found no wallet-drainer behavior, clipboard tampering, hidden forms, or content cloaking. These results are mitigating, but they do not outweigh the blacklist signal. Automated page capture was also met with a bot-protection challenge, which limited how much on-page content could be inspected. Evidence:

• Homepage: the page title presents the site as "About GEODNET: News, Founding Team, Investors & Blockchain DePIN Events" on a domain that spells the name differently.
• External reputation: two engines rated the domain malicious and three suspicious, with one major security vendor among the flagging sources.
• Registration provenance: the domain was registered on 2026-08-19 (~0.18 years, about two months old) through NICENIC INTERNATIONAL GROUP CO., LIMITED.
• Archive depth: 1 archive snapshot, captured in 2026 (1 year tracked), so there is no meaningful prior history.
• Homepage behavior: 102 external XHR calls (11 to non-whitelisted destinations) and 17 external POST requests (5 to non-whitelisted destinations) were observed, with 4 console errors.

Regulatory Verification Notes

The captured homepage content shows no clear licensing, registration, or legal-entity disclosure, and no named operating company could be tied to the site. The site's connection to any real-world project or organization is therefore unconfirmed. No third-party broker or regulatory-database match exists for the domain. This absence of a listing is not a regulatory finding either way. Any association with the project named in the homepage title rests on the site's own claims and cannot be treated as established. The founding-team and investor claims in the title are unverifiable on the evidence available. Evidence:

• Homepage: the available content gives no company name, license number, or registry reference.
• Transport encryption: the TLS certificate was issued by WE1 at domain-validated (DV) level and is valid to 2027-01-15. DV validation confirms control of the domain only, not the operator's identity.
• Third-party coverage: no broker-reputation match was found for the domain.

What to Verify Next

Before any engagement, the claimed association with the named project should be checked against that project's officially published channels, reached independently of this site. The exact domain spelling should be compared character by character with the official one. Any request to connect a wallet, log in, or submit data through this domain should be declined until the external detections are resolved. Official support and contact channels should be confirmed through an independent route rather than through links on this site. Evidence:

• Homepage: the title's project name differs in spelling from the domain name, which is the first point to check.
• Domain registration: the domain is about two months old (registered 2026-08-19), so no long-standing record supports the claimed association.
• Homepage behavior: the page sends data to several external, non-whitelisted destinations, so no data should be submitted to it.

Summary Verdict

The overall posture is critical and clearly cautionary. Confirmed external blacklist detections, combined with a very young domain, a lookalike naming pattern, and extensive third-party data traffic, outweigh every protective or technical positive signal. The site's operator identity is unverified. The available evidence does not support treating the site as trustworthy for any sensitive purpose.

Infrastructure Integrity

The site is served through Cloudflare's CDN and WAF, and every observed address is a Cloudflare edge address, so the real origin server could not be observed. This is only a mitigating factor, because Cloudflare protection says nothing about the legitimacy of the content behind it. The valid TLS certificate and the mainstream hosting provider do not offset the external threat detections. A heuristic flag for a young domain with sparse subdomains is consistent with the domain's recent creation but is unconfirmed on its own. Evidence:

• Hosting: the site is served from AS13335 (CLOUDFLARENET, Cloudflare, Inc., US), with 4 edge IPs observed and no origin candidates.
• Transport encryption: the DV certificate was issued by WE1 and expires 2027-01-15 (81 days remaining at the time of analysis).

Closing Assessment

The site should be treated as high-risk. Interaction should be limited to passive, read-only viewing at most, with no wallet connections, logins, credential entry, downloads, or payments until the external detections are cleared and the operator's identity is independently confirmed. Organizations should consider blocking the domain pending re-assessment.