---
title: "Is aml-check-a2y.pages.dev a Scam? Trust Score 5/100"
source: TrustSniffer
type: Website trust & fraud report
subject: "aml-check-a2y.pages.dev"
verdict: "Critical Risk"
title: "Is Pages a scam? aml-check-a2y.pages.dev trust score 5/100"
trust_score: 5
classification_confidence: 75
canonical_url: https://trustsniffer.com/report/aml-check-a2y.pages.dev
assessed: 2026-10-29
---

# Is Pages a scam? TrustSniffer's high-risk assessment of aml-check-a2y.pages.dev: 5/100

## Verdict


**Verdict: Critical Risk, trust score 5/100.** aml-check-a2y.pages.dev shows high-risk / scam indicators.

This assessment found strong scam indicators. Do not pay, sign in, or share personal details with this site.

Labels: Sensitive Interaction Risk, Governance Risk

Assessed 2026-10-29 by automated analysis. Classification confidence 75%.

## Evidence status and limitations


Evidence completeness: Not recorded

- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.

## At a glance

The checks that decide most of this verdict.

| Check | Result | Status |
| --- | --- | --- |
| Malware engines | 11 flagged it (VirusTotal) | Risk |
| Google Safe Browsing | Not listed (Google) | Clear |
| Abuse reports on the host | 0% confidence (AbuseIPDB, 1 report; shared hosting inflates reports) | Clear |
| Domain age | 2.1 years old (Registered history) | Clear |
| Web archive | Archived since 2024 (12 snapshots) | Clear |
| Certificate | Encrypted connection (Issued by WE1) | Noted |

## The page as captured


![Screenshot of the aml-check-a2y.pages.dev homepage captured during the TrustSniffer assessment](https://trustsniffer.com/outputs/aml-check-a2y.pages.dev/screenshots/first.png)

_What aml-check-a2y.pages.dev served when TrustSniffer captured it on 2026-10-29. The page may look different now._

## Key findings


- Automated classification: Sensitive Interaction Risk.
- Domain age: 1 to 3 years (registration continuity).
- Public web-archive history exists since 2024.
- At least one reputation service TrustSniffer consulted had flagged this domain at assessment time.

## Full analysis


### Security Alert

Fortinet, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

The domain aml-check-a2y.pages.dev is a subdomain on a public web-hosting platform. Its name suggests an anti-money-laundering or compliance-screening service. When the homepage was requested, the visitor was served a hosting-provider interstitial titled "Suspected Phishing" instead of any business content. No product, company description or service offering could be read from the site. Its apparent purpose is therefore a verification or onboarding-style lure, which the available evidence cannot confirm or rule out.


### Scam/Impersonation Risk

This site carries a **confirmed blacklist listing**. A large cluster of independent security engines, including two top-tier vendors, classify the domain as malicious, and the hosting provider's own interstitial labels it as suspected phishing. This convergence is the decisive factor. Infrastructure protections and a valid certificate cannot offset it. The name pattern also frames the domain as a compliance or identity-check service. Pages of that kind are commonly used to collect identity documents, credentials or payment details under a pretext of regulatory screening. No conflicting legal-entity names or brand impersonation were observed, so the risk rests on the reputational listing and not on identity contradictions. Behavioral testing found no wallet-connection prompts, clipboard manipulation, hidden forms, external password forms or fingerprinting. The site's content was not fully observable, so these clean results do not reduce the risk. Evidence:

- Homepage: the captured page was a suspected-phishing warning interstitial, not site-authored content.
- Reputation checks: 11 engines rated the domain malicious and 1 suspicious, including 2 top-tier vendors, which triggered a hard score ceiling.
- Domain provenance: about 2.1 years old, with 12 archive snapshots from 2024-09 to 2026-08 (3 years tracked). Archive history alone does not offset the listing.
- Behavioral testing (3 of 3 runs completed): 50 external XHR requests and 5 external POSTs, all to whitelisted destinations. 13 console errors and 1,508 DOM mutations after interaction.

### Regulatory Verification Notes

The evidence does not tie the site to any identifiable operator, licensed entity or registration number. Operator ownership is opaque. That matters for a service whose name implies compliance screening, because such a function would normally sit with a named, supervised provider. No regulator or third-party broker record corroborates the site. The hosting platform's warning and the external detections are reputational signals about the site's conduct, not a licensing finding. The absence of verifiable operator details is a verification matter and not independent evidence of wrongdoing. Here it compounds a listing that is already decisive. Evidence:

- Hosting: served from AS13335 (Cloudflare, Inc., US) on a shared platform subdomain, so no standalone registration identifies the operator.
- Transport security: TLS certificate issued by WE1 (DV, domain-validated only), valid to 2027-01-12. DV confirms control of the domain, not the operator's identity.
- Homepage: no company name, licence or registration reference could be associated with the site.

### What to Verify Next

Anyone who received a link to this domain should establish through an independent route whether the supposed sender or organisation actually uses it. Use contact details taken from an official registry, a printed statement or a previously known phone number, and do not use anything on this site. If the site claims to represent a bank, exchange or regulated provider, confirm the entity and its licence directly in the relevant public register and compare the official domain. Messages or documents that point to this address should be reported to the sender's organisation and the hosting provider's abuse channel, and retained as evidence. Evidence:

- Homepage: the request returned an access-denied status (403) behind a bot challenge, so no independent content review was possible.
- Hosting: the domain sits on a shared free-hosting namespace, which allows rapid creation and replacement of lookalike pages.

### Summary Verdict

The available evidence places this domain in a clearly high-risk posture. Multiple independent threat sources converge on malicious classification, and no countervailing evidence of a verified, accountable operator exists. Legitimacy cannot be inferred, and the site should be treated as hostile until its status changes.


### Infrastructure Integrity

The site is fronted by Cloudflare's CDN and WAF, and all four observed addresses are provider edge nodes. No origin server could be seen. This protection is a mitigating factor only and does not vouch for the content behind it. The single abuse report on one edge address relates to shared provider infrastructure and carries no weight against the site. The edge layer also prevents independent verification of where the content is hosted.


### Closing Assessment

Do not enter credentials, upload identity documents, make payments or download files from this site. Limit any contact to non-interactive viewing, if that is needed at all. Users who have already submitted information should change affected passwords, notify their bank or provider, and report the incident.


_Written analysis generated 2026-10-29 by the TrustSniffer Analysis Engine from the evidence in this report._

## What the analysis found

4 findings contributed to this verdict, raised by governance, external reputation, behaviour in a sandbox, registration and ownership.

### 01 Governance
- A threat feed lists this domain as malicious, and that caps the score whatever the other checks found. (Governance `rule:GOV_CRITICAL_BLACKLIST`)

### 02 External reputation
- An external threat feed lists this domain: either Google Safe Browsing marked it malicious, or a significant number of malware engines flagged it. (External reputation `rule:EXT_BLACKLIST_CRITICAL`)

### 03 Behaviour in a sandbox
- Most of what the page loaded came from other domains rather than from this one. (Behaviour in a sandbox `rule:BEHAV_EXTERNAL_RATIO_HIGH`)
- The structure of the page changed sharply while it was loading. (Behaviour in a sandbox `rule:BEHAV_DOM_DENSITY_SPIKE`)
- The page produced an unusually high number of errors while it ran. (Behaviour in a sandbox `rule:BEHAV_CONSOLE_ERRORS_HIGH`)

### 04 Registration and ownership
- The public registration record for this domain is incomplete. (Registration and ownership `rule:KF_WHOIS_INCOMPLETE`)

### Signals weighed against the site

- AbuseIPDB: 1 report on hosting IP 2606:4700:310c::ac42:2f83 (Cloudflare, Inc., Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.

## Identity verification


| Field | Value |
| --- | --- |
| Status | UNKNOWN |
| Identity score | 50/100 |
| Identity verification confidence | 30% |

- AI page analysis unavailable (page captured; identity not AI-verified)

_Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence._

## What TrustSniffer observed

First-party facts recorded during the assessment of aml-check-a2y.pages.dev.

- The request stayed on aml-check-a2y.pages.dev. It was not redirected to another domain. (Clear)
- The earliest public archive of this site is from 2024-09-07. (Clear)
- It is hosted on CLOUDFLARENET, from a server in US. (Noted)

## Domain intelligence


| Field | Value |
| --- | --- |
| Registrar | Not available |
| Hosting | CLOUDFLARENET - Cloudflare, Inc., US |
| Country | US |
| Server IP | 2606:4700:310c::ac42:2f83 |
| Name servers | Not available |
| CDN / edge network | Detected (cloudflare) |
| Resolved IP addresses | 4 |
| Edge IP addresses | 4 |
| Likely origin IP addresses | 0 |
| SSL issuer | WE1 |
| SSL expiry | 2027-01-12 |
| Domain age | 2.14 years (continuous registration) |
| Domain expiry | Not available |
| Archive first seen | 2024-09-07 |
| Archive snapshots | 12 |
| Reputation | VirusTotal: 11 flagged \| AbuseIPDB: 0% confidence, 1 report \| Google Safe Browsing: 0 matches |

## About this assessment


**Was this report useful?** Tell other people what you think of TrustSniffer, good or bad. An honest review helps others decide whether to rely on these checks. [Review TrustSniffer on Trustpilot](https://www.trustpilot.com/review/trustsniffer.com)

A trust score summarises the evidence TrustSniffer could collect about aml-check-a2y.pages.dev at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.

TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.

## Related on TrustSniffer
- [xpfunxyz.pages.dev](https://trustsniffer.com/report/xpfunxyz.pages.dev), a similar name (Critical Risk, 0/100)
- [weroll-byte-welcome-bob-the-builder.pages.dev](https://trustsniffer.com/report/weroll-byte-welcome-bob-the-builder.pages.dev), a similar name (Critical Risk, 0/100)
- [votes-okxpolls-105.pages.dev](https://trustsniffer.com/report/votes-okxpolls-105.pages.dev), a similar name (Critical Risk, 0/100)
- [vote-polls954.pages.dev](https://trustsniffer.com/report/vote-polls954.pages.dev), a similar name (Critical Risk, 5/100)
- [kuroro-xyz.pages.dev](https://trustsniffer.com/report/kuroro-xyz.pages.dev), a similar name (Critical Risk, 2/100)
- [studio-vote-com.pages.dev](https://trustsniffer.com/report/studio-vote-com.pages.dev), a similar name (Critical Risk, 0/100)
- [resyncingchain-dapps.pages.dev](https://trustsniffer.com/report/resyncingchain-dapps.pages.dev), a similar name (Critical Risk, 5/100)
- [claim-guardian.pages.dev](https://trustsniffer.com/report/claim-guardian.pages.dev), a similar name (Critical Risk, 4/100)
- [bookresellertool.com](https://trustsniffer.com/report/bookresellertool.com), another site assessed as critical-risk (Critical Risk, 0/100)
- [dashenopticians.com](https://trustsniffer.com/report/dashenopticians.com), another site assessed as critical-risk (Critical Risk, 0/100)
- [Every website and wallet TrustSniffer has assessed](https://trustsniffer.com/directory), the full risk directory
- [Other domains assessed as high-risk or phishing](https://trustsniffer.com/directory/phishing-domains), same verdict band
- [Check another website](https://trustsniffer.com/web-intelligence), run a new assessment
- [Check a crypto wallet address](https://trustsniffer.com/on-chain-risk), on-chain screening
- [The TrustSniffer Risk Index](https://trustsniffer.com/stats), how this verdict compares

## Guides
- [99.5% of flagged USDT wallets were frozen](https://trustsniffer.com/blog/99-5-of-flagged-usdt-wallets-were-frozen)
- [Trading Platform Scam: Checking a Blocked Balance](https://trustsniffer.com/blog/trading-platform-scam-checking-a-blocked-balance)
- [Connect a Wallet to a Scam Site: What Happens](https://trustsniffer.com/blog/connect-wallet-to-a-scam-site-what-happens)

---
*Source: [TrustSniffer](https://trustsniffer.com/report/aml-check-a2y.pages.dev) — independent automated trust & fraud analysis. Cite as https://trustsniffer.com/report/aml-check-a2y.pages.dev · assessed 2026-10-29.*