Is cookiesbyqui.online safe?

A borrowed brand name on a three-day-old domain

The registrable domain is only three days old, which is the single most telling fact here. Independent research identifies 'Cookies by Qui' as an existing business serving Geelong and neighbouring regions from cookiesbyqui.com.au. The .online domain reuses that exact name but has no connection to the cookie business, so visitors who arrive expecting baked goods land on something entirely different.

What they find instead is a page styled as an Envato Market product listing. It carries the EnvatoMarket header, a 'Regular License' block priced at $88, an 'Included: ASAPJP ONLINE' line, a $5 figure and a $100.00 twelve-month support option, plus a promotional line asking why ASAPJP is 'so viral' and describing it as an interactive entertainment landscape. None of this is a real software product; it is marketplace furniture used to make an unknown service look legitimate.

The page also carries a user-review heading in Indonesian about 'the story behind the sensation of ASAPJP interactive entertainment', reinforcing that the whole presentation is built around promoting the ASAPJP brand rather than selling anything genuine.

Every action button leads off-site to a second domain

The site's own call-to-action buttons — LOGIN, DAFTAR, Link Alternatif, Live Chat and Promo — do not keep the visitor on cookiesbyqui.online. Each one resolves to cookiesbyqui.pages.dev, a separate host. 'Daftar' and 'Link Alternatif' are Indonesian for register and mirror/alternative link, the standard vocabulary of gambling-style portals that rotate domains to stay reachable.

The only outbound commercial link that is not part of that funnel points to elements.envato.com with a subscription pitch for unlimited downloads. That is a real third-party marketplace, and its presence here is decorative: it borrows Envato's credibility without any indication that this page is an authorised Envato listing.

The page provides no contact email, no business registration and no operator identity. The absence of any way to reach a responsible party, combined with the off-site funnel, means a visitor who registers or deposits on the destination host has no recourse against the party behind this domain.

Clean technical checks do not make this trustworthy

The browser threat feed returned no threat warning and the saved TLS check found a valid encrypted connection. Those results mean no known malicious payload was flagged at scan time; they say nothing about who runs the site or what happens after a visitor clicks through. A brand-new domain with a cloned template and an off-site registration funnel can pass both checks easily.

The operator risk is what drives the score. A three-day-old domain, a name lifted from an unrelated real business, a fake marketplace listing and a redirect to a second host for registration together describe a deceptive commercial front rather than a shop, a download portal or a legitimate service. The destination service behind ASAPJP is not described anywhere on the captured page, so its true nature remains unverified.