Is sodex.live a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

sodex.live is a very recently registered .live domain. When automated analysis captured its homepage, the page returned a Cloudflare interstitial headed "suspected phishing" instead of ordinary site content. Because the page itself was a warning screen, the site's products and business model could not be established from what it presented. The domain's apparent purpose is unconfirmed, and it should be treated as an unverified, newly created web property that currently attracts security warnings.

Scam/Impersonation Risk

Multiple independent threat signals converge on this domain. A confirmed blacklist presence is recorded, with a meaningful cluster of malicious and suspicious detections from major security vendors, including several top-tier ones. The homepage the analysis encountered was a phishing-suspicion warning from the site's own CDN provider. No brand impersonation or conflicting legal identities were observed, so the risk rests on the reputation and phishing-warning signals, not on identity contradictions. Behavioural testing found no wallet-drainer activity, clipboard manipulation, hidden forms, or credential posts to external hosts. Even so, the page generated a heavy volume of third-party network traffic: dozens of cross-origin background requests and several external POST submissions. It also produced a large number of script errors and a very large burst of page changes after interaction. These traits are consistent with an unstable or heavily scripted front end, and they do not offset the blacklist evidence. The combination of a brand-new domain and active threat listings is a pattern commonly associated with short-lived phishing or malware infrastructure. The posture is therefore elevated risk, and credential entry, wallet connection, and payment on this domain are unsafe.

Regulatory Verification Notes

The captured homepage presented no legal entity name, licence, registration number, or terms of service, so there is nothing on it to check against a regulator or corporate registry. The operator cannot currently be tied to any real-world company or person, and the site's very short history gives no track record that could substitute for that. No third-party broker or regulatory-database record matched this domain, which adds no reputational context either way. The blacklist signals described above are the dominant concern. This disclosure gap would be a verification item on its own, but here it compounds the threat evidence and does not stand alone.

What to Verify Next

Before any engagement, the operator should be required to prove who it is through an independent route. That means a named legal entity, a registry-verifiable registration, and any claimed licence confirmed directly with the issuing authority. Official contact channels should be confirmed through a source that does not originate from this domain. Any claimed affiliation with an established brand or protocol should be checked against that brand's own verified channels, and not against links or references found on this site. The domain's threat listings should be re-checked after the operator has remediated or disputed them. Until then, nothing should be downloaded from the domain.

Summary Verdict

The available evidence supports an elevated-risk posture. A confirmed blacklist, multiple security-vendor detections, a phishing-suspicion warning on the landing page, and the absence of any established history converge on the same conclusion. Legitimacy is not supported, and the operator's identity is unverified.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and WAF, and every observed address is a Cloudflare edge address, so the true origin server is not visible. A valid, known-issuer TLS certificate and bot protection are in place. These are mitigating technical hygiene factors only. Such protections are available to any customer, benign or malicious, and they cannot offset the reputation findings. The edge-only visibility also prevents independent verification of where the content is actually hosted.

Closing Assessment

This domain should be treated as unsafe for any sensitive interaction. Account login, credential entry, wallet connection, and payments or transfers should all be avoided. At most, it should be viewed passively from an isolated environment, and no files should be downloaded from it. Any link that led here through an unsolicited message should be reported and not followed.