Is apes-verification.pages.dev a scam? TrustSniffer's high-risk assessment: 19/100

Overview

This website is a minimal, single-page site published on a shared free-hosting subdomain under the name "apes-verification", with the page title "$APES". It presents only a very short block of text, roughly a sentence or two, with no visible product, company, or service description. Its apparent purpose is a token-themed or "verification"-style landing page, the kind used to steer visitors toward a crypto-asset interaction. No stated business model is observable.

Scam/Impersonation Risk

Contradictory signals are present and weigh heavily. Multiple threat-intelligence engines currently flag the site as malicious or suspicious, and the site is blacklisted by external reputation sources. This is a confirmed reputational contradiction, not a speculative one. The behavioral analysis adds a second, independent warning. After simulated user interaction, the homepage materially changed its semantic content and appearance compared with its initial render, which is strong cloaking behavior. Cloaking is a technique for showing different content to automated reviewers and to real visitors, and it is a recognized evasion pattern. The page also made several background requests to third-party destinations. About three quarters of its observed network activity at peak was external, and some of those destinations were not recognized as commonly trusted services. The pairing of a token-style ticker with the word "verification" in the domain name is a recognizable lure pattern: it implies an eligibility or authenticity check that the page itself never explains. The domain also closely resembles the hosting platform's own namespace, which is consistent with a throwaway deployment rather than an established brand presence. Some behaviors that are typical of wallet-drainer pages were not observed in the sandbox runs. These include wallet-connection prompts, clipboard tampering, hidden forms, and credential posts to external hosts. This is not exculpatory, because content that changes after interaction can expose such mechanics only to certain visitors. No conflicting legal identities or confirmed brand impersonation were found, since no identity is presented at all. Evidence:

• Homepage: the rendered page changed materially after interaction, and semantic and visual differences were recorded against its first render.
• Homepage: 6 external background requests were observed across 3 sandbox runs, 3 of them to non-whitelisted destinations, with external activity peaking at 72.7% and 3 console errors logged.
• Reputation checks: 2 engines rated the domain malicious and 1 suspicious, with corroboration from a separate external blacklist.
• Domain provenance: the domain is about 2.1 years old, and the web archive holds 8 snapshots spanning 2024–2025 (2 years tracked).

Regulatory Verification Notes

The single captured page carries no company name, legal entity, terms, privacy policy, licensing claim, or registration number. Because the page itself offers no operator identity, nothing on the site can be independently connected to a real-world person or organization, and the real-world operator remains unidentified. No third-party broker or regulatory record matched this domain. That is neutral context, not an endorsement, and it supplies no assurance of authorization to offer any financial or asset-related service. Technical hygiene alone does not offset the reputational findings above. The site has a valid, correctly issued transport-encryption certificate, but a certificate only proves encrypted transport to this hostname and says nothing about the operator's legitimacy. Evidence:

• Homepage: about 162 characters of visible text, with no legal entity, licence, address, or policy disclosure.
• Hosting: served from AS13335 (Cloudflare, Inc., US).
• Transport encryption: TLS certificate issued by WE1 (DV, domain validation only), valid to 2027-01-12 with about 77 days remaining at the time of analysis.
• Regulatory matching: no broker-reputation record matched this domain.

What to Verify Next

Before any engagement, anyone considering this site should establish through independent means who, if anyone, operates a project called "$APES" and whether this domain is a sanctioned channel for it. That means checking the project's official announcements via sources reached independently of this site, not through links on this page. Any claimed verification, eligibility, or distribution mechanism should be confirmed with the supposed issuer through a separately sourced route. Official support and contact channels should be confirmed the same way. Reviewing the live page only in an isolated, non-production environment with no wallet or accounts attached would allow safe observation of any further content changes. Evidence:

• Homepage: the page names no issuer, contact route, or official channel that could be used for confirmation.
• Homepage: the title and domain wording imply a "verification" step with no documented process behind it.
• Behavior: content shifted after interaction, so what a visitor sees may depend on how they engage.

Summary Verdict

The overall posture is high-risk. Confirmed adverse reputation, evasive page behavior, and a lack of any attributable operator outweigh the site's technical hygiene and its short but continuous history. The site is classed as unsafe for sensitive interaction, with only passive observation compatible with the assessment.

Infrastructure Integrity

The site is delivered through Cloudflare's content-delivery and web-application-firewall network, hosted on Cloudflare's US-registered address space. All four observed addresses are shared edge servers, and the origin server was not observable. This reflects ordinary platform hosting and is a mitigating factor only. Edge-only visibility prevents independent verification of the true host and can mask rapid content swaps, so the infrastructure cannot offset the reputational and behavioral findings. Evidence:

• Hosting infrastructure: 4 edge addresses observed, all within AS13335, with no origin candidates.
• Hosting infrastructure: the platform-level address range is classified as shared CDN infrastructure with no abuse reports recorded against it.

Closing Assessment

The site should be treated as unsafe for any login, credential entry, wallet connection, or financial transaction. Passive, read-only viewing from an isolated environment is the only proportionate use. Nothing should be downloaded or signed, and any pending approvals or credentials already shared with the site should be reviewed and revoked.