Verdict
This assessment found strong scam indicators. Do not pay, sign in, or share personal details with this site.
43fffeeww2.pages.dev shows high-risk / scam indicators.
Evidence status and limitations
Evidence completeness: Not recorded
- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.
At a glance
The checks that decide most of this verdict.
| Malware engines | 5 flagged itVirusTotal | Risk |
|---|---|---|
| Google Safe Browsing | Not listedGoogle | Clear |
| Abuse reports on the host | 0% confidenceAbuseIPDB, 0 reports; shared hosting inflates reports | Clear |
| Domain age | 2.1 years oldRegistered history | Clear |
| Web archive | Archived since 20246 snapshots | Clear |
| Certificate | Encrypted connectionIssued by WE1 | Noted |
The page as captured
Key findings
- Automated classification: Sensitive Interaction Risk.
- Domain age: 1 to 3 years (registration continuity).
- Public web-archive history exists since 2024.
- At least one reputation service TrustSniffer consulted had flagged this domain at assessment time.
Full analysis
Security Alert
Fortinet flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.
This website is a single-page site hosted on a free subdomain of a public web-hosting platform. It presents itself under the title "The Open Network Foundation", which is the framing of a non-profit or ecosystem body. The captured homepage text is short, and no products, transaction mechanics or named operator could be extracted from it. Its apparent purpose is to look like an organisational or informational front, but its real function and operator are unconfirmed.
Scam/Impersonation Risk
Contradictory signals are present and substantial. Several independent security engines currently flag the domain as malicious, and one flagging engine is a well-established tier-one security vendor. The domain also sits on an external blacklist, so it is blacklisted on the strength of this converging third-party detection. No confirmed brand impersonation, phishing page or conflicting legal identities was observed in the captured content. The risk comes from the reputation findings, not from page-level fraud mechanics. Nothing in the content ties the "Foundation" framing to any real organisation, so the name carries no assurance. Behavioural testing showed no wallet-connect prompts, clipboard manipulation, hidden forms, content cloaking or credential posts to outside parties. The page does generate heavy outbound traffic. Most of its network activity goes to third-party hosts, including several background data requests and form-style submissions to destinations outside the platform's usual set. Its console also logged repeated script errors during the session. Together these indicate a page that sends data to external endpoints without disclosing why, which is consistent with the reputation findings. Evidence:
- Homepage: the page presents itself as "The Open Network Foundation" and gives no verifiable operator.
- Homepage behaviour: roughly 81 background requests went to outside hosts. Six of these were to unrecognised destinations, and 3 of 6 external POST submissions went to unrecognised destinations.
- Homepage behaviour: 13 console errors were logged across three successful test runs.
- Domain provenance: registered about 2 years ago (about 2.06 years), with 6 archive snapshots spanning 2024–2026 (3 years tracked).
Regulatory Verification Notes
No regulator, licence or corporate registration is connected to this site. No third-party broker-reputation record exists for it, so there is no reputational context to weigh. The operator's identity is not independently verified. Ownership is opaque, and that opacity is an administrative limitation, not an identity contradiction, since no conflicting legal entities were found. A foundation-style name with no verifiable legal entity behind it cannot be treated as a credible institutional claim. The site's transport encryption is valid but is only a basic domain-validated certificate. It confirms an encrypted connection and says nothing about who operates the site. Evidence:
- Homepage: no licence, registration number or legal entity is attached to the "Foundation" name.
- Hosting: served from AS13335 (Cloudflare, Inc., US).
- Transport encryption: TLS certificate issued by WE1 (DV), valid to 2026-12-16.
What to Verify Next
The organisation named in the page title should be checked against official corporate and non-profit registries. Any link between this address and a real foundation should be confirmed through that organisation's own independently sourced channels, not through anything on this page. Any official contact route should be obtained offline or from a known-good source. The current malicious-detection status should be rechecked after a reasonable interval, because a compromised or recycled address can be cleaned and delisted. Evidence:
- Homepage: the foundation framing has no corroborating registry or contact detail.
- External reputation: multiple security engines currently flag the domain, and it is also on an external blacklist.
- Provenance: the domain is young, with a thin archive record.
Summary Verdict
The overall posture is high risk. Multiple independent detections and a confirmed blacklist listing outweigh every neutral or positive technical attribute. A valid certificate and a stable, well-known hosting provider do not offset the reputational findings. Legitimacy is not established, and the operator's real-world identity is unconfirmed.
Infrastructure Integrity
The site sits behind Cloudflare's CDN and WAF, and every observed address belongs to the CDN's edge network. The origin server was not observable, which prevents independent hosting verification and could mask quick content swaps. This protection is only a mitigating factor. It shields the site from some exposure but does not vouch for the operator or for the site's content.
Closing Assessment
Read-only viewing is the most this site should be used for. Logging in, submitting credentials, connecting a wallet and any financial interaction should be avoided. Any files from this address should not be downloaded until the threat listings are independently cleared.
Written analysis generated 2026-10-29 by the TrustSniffer Analysis Engine from the evidence in this report.
What the analysis found
3 findings contributed to this verdict, raised by external reputation, behaviour in a sandbox, registration and ownership.
01 External reputation
- An external threat feed lists this domain: either Google Safe Browsing marked it malicious, or a significant number of malware engines flagged it.External reputation
rule:EXT_BLACKLIST_CRITICAL
02 Behaviour in a sandbox
- Most of what the page loaded came from other domains rather than from this one.Behaviour in a sandbox
rule:BEHAV_EXTERNAL_RATIO_HIGH - The page sent data to a destination TrustSniffer does not recognise.Behaviour in a sandbox
rule:BEHAV_NONWHITELISTED_POSTS - The page produced an unusually high number of errors while it ran.Behaviour in a sandbox
rule:BEHAV_CONSOLE_ERRORS_HIGH - The page made many background requests to other domains while it was open.Behaviour in a sandbox
rule:BEHAV_EXTERNAL_XHR_HEAVY
03 Registration and ownership
- The public registration record for this domain is incomplete.Registration and ownership
rule:KF_WHOIS_INCOMPLETE
Identity verification
| Status | UNKNOWN |
|---|---|
| Identity score | 50/100 |
| Identity verification confidence | 30% |
- AI page analysis unavailable (page captured; identity not AI-verified)
Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence.
What TrustSniffer observed
First-party facts recorded during the assessment of 43fffeeww2.pages.dev.
- The request stayed on 43fffeeww2.pages.dev. It was not redirected to another domain. Clear
- The earliest public archive of this site is from 2024-10-07. Clear
- It is hosted on CLOUDFLARENET, from a server in US. Noted
Domain intelligence
| Registrar | Not available |
|---|---|
| Hosting | CLOUDFLARENET - Cloudflare, Inc., US |
| Country | US |
| Server IP | 2606:4700:310c::ac42:2f91 |
| Name servers | Not available |
| CDN / edge network | Detected (cloudflare) |
| Resolved IP addresses | 4 |
| Edge IP addresses | 4 |
| Likely origin IP addresses | 0 |
| SSL issuer | WE1 |
| SSL expiry | 2026-12-16 |
| Domain age | 2.06 years (continuous registration) |
| Domain expiry | Not available |
| Archive first seen | 2024-10-07 |
| Archive snapshots | 6 |
| Reputation | VirusTotal: 5 flagged | AbuseIPDB: 0% confidence, 0 reports | Google Safe Browsing: 0 matches |
About this assessment
A trust score summarises the evidence TrustSniffer could collect about 43fffeeww2.pages.dev at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.
TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.