Is cenderahati.my safe?
http://cenderahati.my/
Checked on
How we checked
Coverage: complete · 4 of 4 applicable core capabilities
- Antivirus (56 of 93 engines answered): completed
- Google Safe Browsing: completed
- page reading: completed
- page capture: completed
- domain records: completed
- web research: completed
New Malaysian corporate-gift storefront with no online checkout and no verifiable operator details
Cenderahati.MY presents itself as a corporate gift and custom merchandise provider based in Johor, Malaysia, and its own copy says it works by quotation rather than online checkout: visitors are asked to send quantity, branding and delivery details and receive a tailored quote. The registrable domain is only 24 days old, the captured page shows no direct contact email, and the site does not disclose a registered company or a verifiable address. Technical checks are clean — no malicious or suspicious detections across 93 engines, no browser threat feed warning, and a valid encrypted connection — but those results only mean nothing malicious was detected, not that the operator is established or safe to transact with. Because the business is new, its own pages could not be fully reviewed for contact and policy detail, and the transaction path runs off-platform to WhatsApp, the score sits in the Moderate Risk band rather than Safe or Low Risk.
Loading saved screenshot
Preparing the saved page preview.
Where this site sits
- Dangerous1–20
- High Risk21–44
- Moderate Risk45–69
- Low Risk70–84
- Safe85–100
The score combines saved evidence strength and analysis quality. Coverage is reported separately.
Why 62/100
Moderate Risk covers scores 45–69. 3 findings pulled the score down; 1 pushed it up.
What pulled the score down
- ModerateThe site claims a Johor base but discloses no registered company or verifiable address in the reviewed material.-24 pts
- MinorThe registrable domain is only 24 days old, so the business has no track record.
- MinorThe captured page shows no direct contact email address.
What pushed the score up
- SupportsNo malicious or suspicious detections across 93 engines, no Safe Browsing warning, and a valid encrypted connection.
Points come from the saved evidence ledger: it lowered the score from 86 to 62 and split those 24 points between the findings that show points; the others carry no points in the ledger. Community reviews never change the Safety Score.
01 · Investigation Brief
Investigation Brief
Cenderahati.MY presents itself as a corporate gift and custom merchandise provider based in Johor, Malaysia, and its own copy says it works by quotation rather than online checkout: visitors are asked to send quantity, branding and delivery details and receive a tailored quote. The registrable domain is only 24 days old, the captured page shows no direct contact email, and the site does not disclose a registered company or a verifiable address. Technical checks are clean — no malicious or suspicious detections across 93 engines, no browser threat feed warning, and a valid encrypted connection — but those results only mean nothing malicious was detected, not that the operator is established or safe to transact with. Because the business is new, its own pages could not be fully reviewed for contact and policy detail, and the transaction path runs off-platform to WhatsApp, the score sits in the Moderate Risk band rather than Safe or Low Risk.
A quotation-based gift shop, not a normal online store
The site describes itself as a corporate gifting service based in Johor and serving clients across Peninsular Malaysia by arrangement, with product availability, customization methods, minimum quantities and lead times confirmed individually. Its own copy states plainly that there is no online checkout or fixed-price bundles, and instead asks visitors to provide estimated quantity, branding requirements and delivery location so a tailored quotation can be prepared.
The storefront is built on WordPress and includes a Shop link, but the commercial flow does not end in a cart or payment page. That is a legitimate model for made-to-order corporate merchandise, and it also means there is no on-site checkout, order confirmation or payment record to inspect.
New domain, no email, no disclosed company
The registrable domain is 24 days old, so there is no long operating history behind the brand. The captured page also shows no direct contact email address, which removes one of the simplest ways for a prospective buyer to verify who they are dealing with before sending money.
The site does not disclose a registered company or registration identifier, and no verifiable physical address appears in the reviewed material. A Johor base is claimed in the site's own text, but that claim is not backed by a checkable address or company record in the evidence available here.
Clean scans do not make a new operator safe
The technical picture is clean: 0 malicious and 0 suspicious detections across 93 engines, no browser threat feed threat warning, and a valid encrypted connection. Nothing in the evidence indicates malware, phishing, a fake download or a browser-level threat.
Those results only establish that no malicious content was detected at scan time. They say nothing about whether the operator will deliver goods, honour a quotation, or still exist in a few months. The adverse weight here comes from the combination of a 24-day-old domain, no contact email, no disclosed company and no independent reputation evidence, not from any technical detection.
Why the score is 62
The site claims a Johor base but discloses no registered company or verifiable address in the reviewed material. Coverage remains separate so missing sources cannot be mistaken for clean results.
02 · Security Evidence
Security evidence
Antivirus Engines
0/ 93
No detectionsFresh result
No detections across 56 engines that rated this URL
No antivirus engine that answered raised an adverse result; 37 had no rating for this URL. This is one signal, not a guarantee.
- Malicious
- 0
- Suspicious
- 0
- Total
- 93
All 93 engine results
- 0xSI_f33d - Unrated
- Abusix - Clean
- Acronis - Clean
- ADMINUSLabs - Clean
- AILabs (MONITORAPP) - Clean
- AlienVault - Clean
- alphaMountain.ai - Unrated
- AlphaSOC - Unrated
- Antiy-AVL - Clean
- ArcSight Threat Intelligence - Unrated
- AutoShun - Unrated
- Bfore.Ai PreCrime - Unrated
- BitDefender - Clean
- Bkav - Unrated
- BlockList - Clean
- Blueliv - Clean
- Certego - Clean
- ChainPatrol - Unrated
- Chong Lua Dao - Clean
- CINS Army - Clean
- CRDF - Clean
- Criminal IP - Unrated
- CSIS Security Group - Unrated
- CTX AI - Clean
- Cyan - Unrated
- Cyble - Clean
- CyRadar - Clean
- desenmascara.me - Clean
- DNS8 - Unrated
- Dr.Web - Clean
- EmergingThreats - Clean
- Emsisoft - Clean
- Ermes - Unrated
- ESET - Clean
- ESTsecurity - Clean
- Forcepoint ThreatSeeker - Unrated
- Fortinet - Clean
- Fortra - Unrated
- G-Data - Clean
- GCP Abuse Intelligence - Unrated
- Google Safe Browsing - Clean
- GreenSnow - Clean
- GreyNoise - Unrated
- Gridinsoft - Unrated
- Guardpot - Unrated
- Heimdal Security - Clean
- Hunt.io Intelligence - Unrated
- IPsum - Clean
- Juniper Networks - Clean
- K7AntiVirus - Unrated
- Kaspersky - Unrated
- LevelBlue - Clean
- Lionic - Clean
- Lumu - Unrated
- Malwared - Clean
- MalwarePatrol - Clean
- MalwareURL - Unrated
- Mimecast - Unrated
- Netcraft - Unrated
- OpenPhish - Clean
- Orcapot - Unrated
- PhishFort - Unrated
- Phishing Database - Clean
- Phishtank - Clean
- PREBYTES - Clean
- PrecisionSec - Unrated
- Quick Heal - Clean
- Quttera - Clean
- Rising - Clean
- SafeToOpen - Unrated
- Sangfor - Clean
- Sansec eComscan - Unrated
- Scantitan - Clean
- SCUMWARE.org - Clean
- Seclookup - Clean
- Snort IP sample list - Unrated
- SOCRadar - Unrated
- Sophos - Clean
- StopForumSpam - Clean
- Sucuri SiteCheck - Clean
- Synthient - Unrated
- ThreatHive - Clean
- URLhaus - Clean
- URLQuery - Unrated
- Viettel Threat Intelligence - Clean
- VIPRE - Unrated
- ViriBack - Clean
- VX Vault - Clean
- Webroot - Clean
- Xcitium Verdict Cloud - Clean
- Yandex Safebrowsing - Clean
- ZeroCERT - Clean
- ZeroFox - Unrated
How security vendors categorise this site
- Googleretail
Each vendor’s own label for the site, saved with the antivirus result. Labels are separate from the engine verdicts above and can disagree with each other.
Security Scans
Checked against the browser threat feeds available to this scan — no hit.
What we observed
Loading saved screenshot
Preparing the saved page preview.
Visual context from the captured page
Corporate Gifts & Custom Merchandise in Malaysia
What the captured page showed
1 observation- 01
Corporate Gifts & Custom Merchandise in Malaysia
What the page says about itself
What the site says about itself, quoted from the pages we read. The site wrote these words; they are not our findings.
- Page title
Corporate Gifts & Custom Merchandise Malaysia - Cenderahati.MY
- Meta description
Explore customized corporate gifts, premium gift sets, mugs, canvas bags, stationery and event merchandise. Request a quotation via WhatsApp from Cenderahati.my.
Pages we read
- Main page/Read
03 · Investigation Story
Investigation story
What the site claims
Corporate Gifts & Custom Merchandise Malaysia - Cenderahati.MY
What we observed
The page content was captured and checked alongside 56 antivirus results.
What independent research found
The search completed without a material external warning or corroborating report.
What remains unverified
The checks completed, but ownership, business claims, and future site behavior can still change after this snapshot.
What kind of site and risk is this?
Threat category
No threat category confirmed
Service and business model
Shop
Observed behavior
Evidence behind this classification
- 01The registrable domain is only 24 days old, so the business has no track record.
- 02The captured page shows no direct contact email address.
- 03The primary order path is a WhatsApp link, and the site states there is no online checkout or fixed-price bundles.
If this is a scam — what it means for you
What happens when a visitor asks for a quote
A visitor who wants to buy is directed to request a custom quotation, and the primary order path is a WhatsApp link labelled 'Order via WhatsApp'. Following it moves the conversation off the website and onto a messaging platform, where the visitor would be expected to discuss quantities, branding and delivery before any purchase.
If this is a scam, how it works
The evidence-backed path
Each stage below is preserved from the grounded analysis and linked to saved evidence.
Because the site states there is no online checkout or fixed-price bundles, any payment and delivery terms would be agreed privately in that chat rather than through a documented on-site transaction. That is the point at which a buyer has the least protection: no published price list, no on-site order record, and no disclosed company or email to fall back on if the arrangement goes wrong.
Treat Cenderahati.MY as an unproven new business rather than an established supplier. Before sending any deposit, ask for the registered company name and number, a full business address, a landline or company email, and a written quotation with delivery dates and payment terms. Prefer payment methods that can be reversed if goods do not arrive, and avoid large upfront transfers arranged only through WhatsApp. If the operator cannot or will not provide verifiable company and address details, buy elsewhere.
Web research findings
Independent findings for cenderahati.my, including public complaints, named review sources, registration records, and look-alike-domain evidence. A missing result is shown as unverified, never converted into a clean bill of health.
No independently sourced scam reports or credibility records were found for cenderahati.my. That is common for new or low-traffic sites and does not clear the site.
Reputation Sources
How this domain rates across independent threat-intelligence and blocklist providers.
04 · Domain & Infrastructure
Domain & infrastructure
The plumbing behind the site — who registered it, how it’s encrypted, where it’s hosted, and where it links out. A valid certificate or a calm server doesn’t mean the business is honest — scam sites pass these checks too. Use this to corroborate the verdict, not to overturn it.
Infrastructure map
How the saved page connected to the wider web.
- Domaincenderahati.my
- Redirects towww.cenderahati.my
- Hosted byShinjiru Technology Sdn Bhd
- Referenceswa.me · wordpress.org
Domain Timeline
- Sep 28, 2026Domain registered
First appeared in WHOIS records — 24 days old when this review was saved.
- Oct 22, 2026Saved security review — Rated Moderate Risk
The evidence in this saved scan is mixed or incomplete; the completed checks are detailed above.
cenderahati.my was registered very recently when this review was saved. Freshly-registered domains are disproportionately used for scams, so a young domain whose evidence is mixed or incomplete warrants extra caution.
Contact Verification
Saved contact details can help identify the operator. Their presence supports traceability; it does not prove the business is trustworthy.
- No direct contact email found on the captured page.
- Phone number listed (60106684172).
- Links to 2 social profiles.
Domain & Encryption
A certificate issued weeks or days before the scan on a domain registered recently is common on short-lived sites, though new legitimate sites look the same.
Certificate issued for cenderahati.my.
Payment providers the page loads
None seen among the outside domains we saved.
Read from the first 20 outside domains the page loads and the shop platform it uses; the web server and platform rows are under Hosting & Technology. A payment script on the page does not prove the shop accepts that method at checkout, or that you are protected.
Redirect Chain
- 1301http://cenderahati.my/
- 2200https://www.cenderahati.my/
Server Reputation
Referenced Domains
Outbound domains this page links to or loads resources from. Each links to its own security scan.
05 · Evidence Ledger
Evidence ledger
- Antiviruscomplete
- Browser threat feedcomplete
- Page contentcomplete
- Analysiscomplete
- Visual evidencecomplete
The conclusion is supported by the evidence saved with this report.
Technical threat
unknownMalware, phishing, credential theft and hostile infrastructure.
No confirmed evidence in this dimension.
Operator / customer risk
suspiciousComplaints, withdrawals, business conduct and commercial traps.
The site claims a Johor base but discloses no registered company or verifiable address in the reviewed material. · The registrable domain is only 24 days old, so the business has no track record.
Source coverage and freshness
Status shows whether usable evidence was saved; finding shows what that evidence observed.
| Source | Result | Completion | Finding | Freshness |
|---|---|---|---|---|
| Antivirus | 0 of 93 engines flagged | Completed | No adverse finding | fresh · analysed Oct 22, 2026 |
| Browser protection | No browser threat-list match | Completed | No adverse finding | this scan · Oct 22, 2026 |
| Page content | Page fetched · HTTP 200 | Completed | No adverse finding | this scan · Oct 22, 2026 |
| Visual evidence | 1 visible observation saved with the page capture | Completed | No adverse finding | this scan · Oct 22, 2026 |
| Independent research | The search completed without a material external finding | Completed | No adverse finding | this scan · Oct 22, 2026 |
- Antivirus
- Result0 of 93 engines flagged
- CompletionCompletedFindingNo adverse finding
- Freshnessfresh · analysed Oct 22, 2026
- Browser protection
- ResultNo browser threat-list match
- CompletionCompletedFindingNo adverse finding
- Freshnessthis scan · Oct 22, 2026
- Page content
- ResultPage fetched · HTTP 200
- CompletionCompletedFindingNo adverse finding
- Freshnessthis scan · Oct 22, 2026
- Visual evidence
- Result1 visible observation saved with the page capture
- CompletionCompletedFindingNo adverse finding
- Freshnessthis scan · Oct 22, 2026
- Independent research
- ResultThe search completed without a material external finding
- CompletionCompletedFindingNo adverse finding
- Freshnessthis scan · Oct 22, 2026
07 · Safety FAQ
Safety FAQ
Common questions, answered directly from the scan data above — so the answers reflect the saved verdict and evidence in this report.
Is cenderahati.my a scam or is it safe?
Is cenderahati.my safe to use?
Has cenderahati.my been flagged by antivirus engines?
Is cenderahati.my on any phishing or malware blacklists?
How old is the cenderahati.my domain?
Does cenderahati.my have a valid SSL certificate?
Where is cenderahati.my hosted?
How often is the cenderahati.my report updated?
08 · Final Verdict
Final verdict
New Malaysian corporate-gift storefront with no online checkout and no verifiable operator details
Cenderahati.MY presents itself as a corporate gift and custom merchandise provider based in Johor, Malaysia, and its own copy says it works by quotation rather than online checkout: visitors are asked to send quantity, branding and delivery details and receive a tailored quote. The registrable domain is only 24 days old, the captured page shows no direct contact email, and the site does not disclose a registered company or a verifiable address. Technical checks are clean — no malicious or suspicious detections across 93 engines, no browser threat feed warning, and a valid encrypted connection — but those results only mean nothing malicious was detected, not that the operator is established or safe to transact with. Because the business is new, its own pages could not be fully reviewed for contact and policy detail, and the transaction path runs off-platform to WhatsApp, the score sits in the Moderate Risk band rather than Safe or Low Risk.
09 · Community
Community
Are you the owner of cenderahati.my?Verify and reply