Is apeterminal-reg-web3.pages.dev a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a Web3-branded site served from a subdomain of a free, shared static-hosting platform, with a name that suggests a crypto trading or "terminal" interface. When the platform was analysed, its homepage returned an access-blocking interstitial instead of product content. That interstitial carried a "suspected phishing" warning title, so no products, claims, or operator details could be observed. Its apparent purpose is to front a crypto-related service or onboarding flow, but the content was never visible.

Scam/Impersonation Risk: Contradictory signals are present, and they carry decisive weight. Several independent security vendors currently flag the domain as malicious or suspicious, including two well-known tier-one engines, and an external blacklist listing is confirmed. The homepage the analysis captured was a block page that itself warned of suspected phishing, which matches the third-party detections. No conflicting legal entities were found and no specific brand impersonation was confirmed. The risk rests on the blacklist and reputation evidence, not on identity inconsistency. The domain's naming is a further concern. It sits on a shared hosting subdomain and combines "terminal", "reg" and "web3" terms, a pattern often used to resemble registration or access portals for crypto platforms. Because the page content was never visible, it is unknown whether the site presents wallet connection, token claims, or yield promises. Browser-behaviour testing found no wallet-drainer activity, clipboard manipulation, hidden forms, or credential posts to third parties. That absence is mitigating but does not offset the confirmed listings, since the site was behind an access challenge during testing. Evidence:

Regulatory Verification Notes: No licence, registration number, company name, or governance information could be assessed. The only page captured was the block interstitial, so no terms, about, or legal pages were reviewed. The real-world operator is not independently connected to any person or organisation, and governance and ownership are opaque. No regulatory or broker-database match was found. No third-party reputational signal exists in that dimension, so this is a verification gap and not a finding. The site is not recognised as a DeFi protocol on any tracked listing, so no on-chain footprint supports any claim it might make. Any financial-services or digital-asset activity the site later presents would need to be backed by verifiable authorisation. Evidence:

What to Verify Next: Because the domain is blacklisted and flagged as suspected phishing, the primary step is to establish whether the site is the genuine property of any claimed brand. That means finding the brand's official address through its own independently sourced channels, such as verified social profiles or a regulator's register, and comparing it to this domain. Any invitation, advertisement, or message that led to this address should be treated as unverified and, where possible, reported to the platform it came from. Wallets and accounts that interacted with the site should be reviewed for unexpected token approvals, and any such approvals revoked. Official support or contact channels should be confirmed only through an independent route, never through links on this site. If the domain's host or the platform owner has published a takedown or abuse notice, that should be checked as well. Evidence:

Summary Verdict: The overall posture is clearly cautionary and high risk. Confirmed blacklist and phishing-oriented detections dominate every other signal and override the technically sound transport security. The site cannot be treated as legitimate on the evidence available, and no identity has been established that could support a more favourable reading.

Infrastructure Integrity: The site is fronted by Cloudflare's CDN and web application firewall, and all observed addresses are edge servers. The origin host was not observable, so hosting cannot be independently attributed to a specific operator. The protective layer and its bot challenge are mitigating in the narrow sense that no malicious browser behaviour was observed. They are not evidence of legitimacy, and they cannot offset the external threat detections. The edge-only view also limits independent hosting verification and would not reveal a rapid swap of what the site serves.

Closing Assessment: The site should not be used for login, credential entry, wallet connection, or any financial interaction. Any browsing should be limited to read-only viewing from an isolated, non-sensitive environment, and nothing should be downloaded from it. Organisations should consider blocking it pending independent clearance.

• Homepage: capture was blocked with an access-denied response, and the page title read as a suspected-phishing warning.
• Reputation: eight engines rated the domain malicious and three suspicious, with two tier-one vendors among them. An external blacklist listing is confirmed.
• Browser behaviour: 24 external background requests and 4 external form-style posts were observed, all to recognised destinations. 20 console errors were logged, and external traffic dominated page activity at about 95% in the peak run.
• Provenance: the domain is about 1.8 years old. The web archive holds 6 snapshots between 2025-01-09 and 2025-03-20 (1 year tracked), a thin history.
• Homepage: only a block-page response was served, so no disclosures could be reviewed.
• Hosting: served from AS13335 (Cloudflare, Inc., US).
• Transport: TLS certificate issued by WE1 (DV, domain-validated only), valid to 2027-01-18, about 82 days remaining.
• DeFi recognition: the domain is not listed on any DeFi protocol tracker, so no TVL or market-cap data exists.
• Homepage: the suspected-phishing warning is the only content observed.
• Reputation: the confirmed listing and multi-vendor detections make an independent authenticity check the first required step.
• Identity: no company or licence information is available on any captured page to anchor a claim.