Is 5202515772.pages.dev a scam? TrustSniffer's high-risk assessment: 3/100

Overview

This is a single-page website published on a free, shared-hosting subdomain with a numeric name. Its homepage carries the browser title "Google", although the address has no visible connection to that brand. The page holds a short block of text and no discernible product, service, or corporate identity. Its apparent purpose cannot be established from its content. It reads as a throwaway or staging-style page rather than a genuine business presence.

Scam/Impersonation Risk

Contradictory signals are present, and they are serious. Several independent threat-intelligence sources currently flag the domain as malicious or suspicious, and an external blacklist listing is confirmed. A blacklisted site is a decisive negative regardless of how clean the surrounding technical setup looks. The homepage compounds this by presenting itself under a major technology brand's name on an unrelated, numeric, free-hosting address. That mismatch is a classic brand-lookalike pattern. No conflicting legal entities appear, because the site names no entity at all. Behavioural testing of the homepage also recorded three suspicious inline scripts, a heavy volume of background requests to third-party destinations (up to roughly three-quarters of observed activity at peak), six outbound POST submissions, and a very high count of client-side errors. The pattern is consistent with ad or tracking injection, or with an unstable or hastily assembled page. No wallet-connection prompts, clipboard tampering, hidden forms, or cloaking were observed. Evidence:

• Homepage: browser title reads "Google" while the hosting address is an unrelated numeric subdomain on a shared platform.
• Homepage behaviour: 3 suspicious inline scripts, 6 external POST requests, and 129 console errors across 3 sandbox runs.
• Reputation checks: 3 malicious and 1 suspicious detections from multi-engine scanning, plus a confirmed external blacklist entry.

Regulatory Verification Notes

The homepage names no operating company, registration number, licence, or regulator, and it has no terms, privacy, or about content. This is a content gap on the site itself and is not, on its own, evidence of wrongdoing. Here it adds to the confirmed reputation problems and leaves the site's real-world operator unverified. No third-party broker or regulatory-database match exists for the domain, so no external attestation of legitimacy is available. The valid transport encryption is a domain-validated certificate only. It confirms an encrypted connection, not the identity or intent of whoever runs the page. Evidence:

• Homepage: no company name, licence, registration data, or legal pages are published.
• Served from AS13335 (Cloudflare, Inc., US).
• TLS certificate issued by WE1 (DV), valid to 2027-01-02, about 68 days remaining.

What to Verify Next

Before any engagement, the site's connection to any claimed brand should be tested independently. Anyone who reached this page through a message, advertisement, or search result should trace the original source and confirm with the supposed brand through its officially published channels. Security teams should check whether the domain appears in their own blocklists, email-gateway logs, or proxy telemetry. They should also check whether any users submitted data to it. If the domain was received as a link, it should be reported to the platform and to the hosting provider's abuse channel. Evidence:

• Homepage: the page offers no verifiable operator or contact route to confirm.
• Reputation checks: current malicious detections justify an internal log and blocklist review.

Summary Verdict

The overall posture is high-risk. Confirmed adverse reputation, a brand-lookalike presentation, and suspicious page behaviour converge, and nothing on the site offsets them. The valid encryption and mainstream hosting give no reassurance about the operator's intent. The site's identity remains unverified, and its content provides no legitimate business basis.

Infrastructure Integrity

The site sits behind a well-known CDN and web application firewall, and every observed address is an edge node. The true origin server is not visible. This provides standard delivery protection and a clean network-level reputation, which mitigates only infrastructure-level concern. However, edge-only visibility also prevents independent hosting verification and can mask rapid content swaps, and it does not offset the reputation risk.

Closing Assessment

The site should be treated as untrusted and limited to read-only observation at most, preferably from an isolated environment. No login, credentials, personal data, or payments should be entered or made, and any links or downloads originating from it should be avoided. Organisations should consider blocking the domain and reporting it.