Is sollab.cc a scam? TrustSniffer's high-risk assessment: 5/100

Security Alert

Fortinet flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

The website at sollab.cc is a very recently registered domain whose homepage currently serves only a bare "404 Not Found" error page, with almost no visible text. It presents no products, branding, services or business model, so its apparent purpose cannot be established from its content.

Scam/Impersonation Risk

The dominant concern is a confirmed external reputation problem. Several independent threat-intelligence sources currently flag the domain as malicious or suspicious, including a tier-one security vendor, and the site is blacklisted on that basis. A domain only a few months old that already attracts this level of adverse detection fits the profile of throwaway infrastructure. Such domains are often registered shortly before being used for malicious campaigns, and the detection is the decisive negative signal here. The blank error page offers no legitimate commercial context to offset it. It also means the content that triggered the detections cannot be seen. Content on a domain like this can change quickly, so what is served today does not predict what will be served later. No brand impersonation, conflicting legal identities or on-page phishing forms were directly observed. Behavioral testing found no external data transmission, wallet-connection prompts, clipboard manipulation, hidden forms or cloaking, so the risk comes from the domain's reputation and age rather than from observed malicious page behavior. Evidence:

• Registration record: domain registered in 2026 (~0.18 years, about 67 days old) through NICENIC INTERNATIONAL GROUP CO., LIMITED, and not yet established.
• Web archive: 330 snapshots, all in 2026 (1 year tracked), which shows recent activity only and no long-term history.
• Reputation checks: three security engines rated the domain malicious and three suspicious, and an external blacklist also lists it.
• Homepage: the captured page is titled "404 Not Found" and contains only about 33 characters of text.

Regulatory Verification Notes

The site gives no basis for a regulatory assessment. The captured homepage is an error page, so no about, terms, privacy or contact content is available. It names no operating company, licence, registration number or jurisdiction, and the real-world operator is not independently identified. This is a verification gap and not evidence of a scam in itself. In this case it adds to the reputational concern because no legitimate institutional context offsets it. No third-party broker or regulator listing was matched for this domain, so no external regulatory standing can be cited in either direction. The technical hygiene observed is basic and does not demonstrate legitimacy: the transport-encryption certificate is valid and issued by a recognised authority, but it is domain-validated only and confirms nothing about who runs the site. Evidence:

• Homepage: no company name, licence, registration number or legal-entity disclosure is visible.
• Hosting infrastructure: served from AS13335 (Cloudflare, Inc., US).
• Transport encryption: TLS certificate issued by WE1 (DV), valid to 2027-01-15.
• Domain registration: ownership details are incomplete, and the domain expires 2027-08-19 (about one year).

What to Verify Next

Before any engagement, the domain's current listing status should be re-checked with the major threat-intelligence and browser-protection services, because content served under it may change. Any invitation to visit this domain, including emails, messages and social-media posts, should be traced to its source. Its legitimacy should be confirmed through a channel obtained independently, not from links or details supplied by the sender. If an organisation claims to operate the site, its identity, licensing and domain ownership should be confirmed directly with that organisation and the relevant registry. Official support and contact channels should also be confirmed offline. If the domain is part of a corporate environment, security teams should consider keeping it blocked or monitored. Evidence:

• Reputation: current adverse detections from multiple sources, as noted above.
• Homepage: no identifying content, so there is nothing on the page to cross-check.
• Domain age: registered within the last three months, so there is no long record to rely on.

Summary Verdict

The overall posture is high-risk. Confirmed adverse threat-intelligence detections on a newly created domain with no identifiable operator or substantive content outweigh the technically sound but basic safeguards. The site cannot be treated as trustworthy at present, and its real-world operator remains unidentified.

Infrastructure Integrity

The site sits behind a mainstream CDN and WAF provider, and all observed addresses are edge servers, so the origin server is not visible. This conceals hosting details and can mask rapid content changes, so it limits independent hosting verification. It is a mitigating factor only and does not offset the reputation risk.

Closing Assessment

The site should not be used for login, credential entry, payments or any financial interaction, and nothing should be downloaded from it. Any contact with the domain should be limited to passive, read-only viewing in a protected environment, and only if necessary. Suspicious links pointing to it should be reported to the security team and blocked.