Is Pages a scam? TrustSniffer's high-risk assessment of airdrop-250.pages.dev: 0/100

Security Alert

Fortinet, Google, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a subdomain on a free, shared web-hosting platform, with a name built around an "airdrop" theme. The name suggests a cryptocurrency or token giveaway. When analysed, the page returned only a short interstitial. That page carried a phishing warning from the hosting provider's protection layer instead of any identifiable business content. It presents no visible brand, product or operator, so its apparent purpose is to attract visitors with a giveaway lure, a pattern commonly used to harvest wallet access or credentials.

Scam/Impersonation Risk

This site carries a confirmed adverse reputation. Multiple independent threat-intelligence sources currently flag it. One is a major browser safe-browsing service, which classifies it under its social-engineering category, the category used for phishing and deceptive-lure pages. Several well-known security vendors also flag it as malicious, and the combined detections place it on a blacklist. The edge protection layer's own warning interstitial, shown in place of the page content, is consistent with these listings. The hostname adds to the concern. It sits on a widely used free hosting domain and pairs a promotional "airdrop" keyword with a numeric suffix, a structure that is cheap to create in bulk and easy to discard and re-register. The site's behaviour under interaction was heavy on third-party calls, with a large volume of background requests to external destinations, a large DOM change after interaction and a notable number of console errors. All of those external destinations were recognised, mainstream services. This reduces the likelihood of covert data exfiltration but does not offset the reputational findings. No wallet-connection prompts, clipboard tampering, hidden forms or credential posts to external hosts were observed in the sandbox runs. No conflicting legal identities and no specific brand impersonation were identified. The risk therefore rests on the confirmed threat listings and the lure-style hostname, not on a proven impersonation of a named entity. Evidence:

• Homepage: the page returned a restricted-access response containing a phishing-warning interstitial from the hosting provider's protection layer, titled as a suspected phishing page.
• Reputation: the browser safe-browsing service flags the domain for social engineering, and ten security vendors rate it malicious, with one more rating it suspicious. Three of these are tier-one vendors: Fortinet, Google and Sophos.
• Domain provenance: the domain is about 0.38 years (~138 days) old. Its web-archive record is thin, with 2 snapshots between 2026-06-16 and 2026-07-04, covering 1 year tracked.
• Behaviour: 86 external background requests and 5 external POSTs were recorded across 3 sandbox runs, with 16 console errors and a peak of 1,508 DOM mutations after interaction.

Regulatory Verification Notes

No licensing, registration or legal-entity information could be assessed. The reviewable content consisted of a protection interstitial and not an about, terms or contact page. The real-world operator therefore cannot be independently connected to any person or organisation, and no regulated status is indicated. No third-party broker or regulatory-database match was found. This lack of a regulatory footprint is a verification matter and is secondary to the reputational findings above. A site that invites token claims would normally be expected to identify its operator and any relevant authorisation, and none is evident. Evidence:

• Legal and identity pages: no terms, privacy, about or licensing content was available in the reviewed material.
• Broker and regulatory reputation databases: no match was recorded for this domain.
• Hosting: the site is served from AS13335 (Cloudflare, Inc., US) and not from infrastructure attributable to a specific operator.
• Transport security: the TLS certificate was issued by WE1 as domain-validated (DV), valid to 2027-01-01. This confirms only encrypted transport and says nothing about who operates the site.

What to Verify Next

Anyone who reached this site through a message, advertisement or social post should treat the original source as the object of verification. The sender or account that supplied the link should be checked through an independent channel. Any claimed project or token should be confirmed against its official website, as published by an established, independently reachable source. A project that really distributes tokens should be reachable at its own domain and not only at a throwaway hosting subdomain. If wallet access or credentials were already entered on this site, the wallet should be treated as exposed. Token approvals should be reviewed and revoked, funds moved to a fresh wallet, and passwords changed where reused. Official support or contact channels for any referenced project should also be confirmed independently. Evidence:

• Homepage: the page offers no verifiable operator, project or token name that could be checked against an official source.
• Hostname: the shared-platform subdomain with a promotional keyword gives no independent route to confirm the sender's identity.
• Reputation listings: the active threat detections mean any prior interaction should be handled as potentially compromising.

Summary Verdict

The overall posture is high risk. Active, converging threat detections from several independent sources outweigh the technically sound elements of the site: encrypted transport, a recognised certificate issuer and consistent hosting. The operator's identity is not independently established, and the site's age and archive history are too thin to offset the adverse reputation. Its classification therefore stays firmly in the cautionary range.

Infrastructure Integrity

The site is fronted by a major CDN and web application firewall (Cloudflare), and all four observed addresses are edge nodes of that network. The origin server was not observable, so hosting cannot be independently attributed to a specific operator. Edge-only visibility also makes it harder to detect rapid content changes behind the front end. This is a mitigating factor for availability and baseline hygiene only. Using a reputable CDN neither demonstrates legitimacy nor offsets the confirmed threat detections. The CDN's own bot-challenge and phishing-warning behaviour is consistent with those detections.

Closing Assessment

The site should not be used for login, credential entry, wallet connection or any financial interaction. Anyone who has already interacted with it should follow the remediation steps above. Viewing the page without entering any data is the only low-exposure use, and it is best avoided. The link should be reported to the platform or channel where it was found.