Is Pages a scam? TrustSniffer's high-risk assessment of aml-check-a2y.pages.dev: 5/100

Security Alert

Fortinet, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

The domain aml-check-a2y.pages.dev is a subdomain on a public web-hosting platform. Its name suggests an anti-money-laundering or compliance-screening service. When the homepage was requested, the visitor was served a hosting-provider interstitial titled "Suspected Phishing" instead of any business content. No product, company description or service offering could be read from the site. Its apparent purpose is therefore a verification or onboarding-style lure, which the available evidence cannot confirm or rule out.

Scam/Impersonation Risk

This site carries a confirmed blacklist listing. A large cluster of independent security engines, including two top-tier vendors, classify the domain as malicious, and the hosting provider's own interstitial labels it as suspected phishing. This convergence is the decisive factor. Infrastructure protections and a valid certificate cannot offset it. The name pattern also frames the domain as a compliance or identity-check service. Pages of that kind are commonly used to collect identity documents, credentials or payment details under a pretext of regulatory screening. No conflicting legal-entity names or brand impersonation were observed, so the risk rests on the reputational listing and not on identity contradictions. Behavioral testing found no wallet-connection prompts, clipboard manipulation, hidden forms, external password forms or fingerprinting. The site's content was not fully observable, so these clean results do not reduce the risk. Evidence:

• Homepage: the captured page was a suspected-phishing warning interstitial, not site-authored content.
• Reputation checks: 11 engines rated the domain malicious and 1 suspicious, including 2 top-tier vendors, which triggered a hard score ceiling.
• Domain provenance: about 2.1 years old, with 12 archive snapshots from 2024-09 to 2026-08 (3 years tracked). Archive history alone does not offset the listing.
• Behavioral testing (3 of 3 runs completed): 50 external XHR requests and 5 external POSTs, all to whitelisted destinations. 13 console errors and 1,508 DOM mutations after interaction.

Regulatory Verification Notes

The evidence does not tie the site to any identifiable operator, licensed entity or registration number. Operator ownership is opaque. That matters for a service whose name implies compliance screening, because such a function would normally sit with a named, supervised provider. No regulator or third-party broker record corroborates the site. The hosting platform's warning and the external detections are reputational signals about the site's conduct, not a licensing finding. The absence of verifiable operator details is a verification matter and not independent evidence of wrongdoing. Here it compounds a listing that is already decisive. Evidence:

• Hosting: served from AS13335 (Cloudflare, Inc., US) on a shared platform subdomain, so no standalone registration identifies the operator.
• Transport security: TLS certificate issued by WE1 (DV, domain-validated only), valid to 2027-01-12. DV confirms control of the domain, not the operator's identity.
• Homepage: no company name, licence or registration reference could be associated with the site.

What to Verify Next

Anyone who received a link to this domain should establish through an independent route whether the supposed sender or organisation actually uses it. Use contact details taken from an official registry, a printed statement or a previously known phone number, and do not use anything on this site. If the site claims to represent a bank, exchange or regulated provider, confirm the entity and its licence directly in the relevant public register and compare the official domain. Messages or documents that point to this address should be reported to the sender's organisation and the hosting provider's abuse channel, and retained as evidence. Evidence:

• Homepage: the request returned an access-denied status (403) behind a bot challenge, so no independent content review was possible.
• Hosting: the domain sits on a shared free-hosting namespace, which allows rapid creation and replacement of lookalike pages.

Summary Verdict

The available evidence places this domain in a clearly high-risk posture. Multiple independent threat sources converge on malicious classification, and no countervailing evidence of a verified, accountable operator exists. Legitimacy cannot be inferred, and the site should be treated as hostile until its status changes.

Infrastructure Integrity

The site is fronted by Cloudflare's CDN and WAF, and all four observed addresses are provider edge nodes. No origin server could be seen. This protection is a mitigating factor only and does not vouch for the content behind it. The single abuse report on one edge address relates to shared provider infrastructure and carries no weight against the site. The edge layer also prevents independent verification of where the content is hosted.

Closing Assessment

Do not enter credentials, upload identity documents, make payments or download files from this site. Limit any contact to non-interactive viewing, if that is needed at all. Users who have already submitted information should change affected passwords, notify their bank or provider, and report the incident.

Signals weighed against the site

• AbuseIPDB: 1 report on hosting IP 2606:4700:310c::ac42:2f83 (Cloudflare, Inc., Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.