Is binance-2fh.pages.dev a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a subdomain on a shared free-hosting platform. Its hostname embeds the name of a major crypto exchange. When captured, it displayed only a Cloudflare security interstitial warning that the site has been reported for potential phishing, with no content from the destination itself. No products, pricing, or services are visible, so the site's business model cannot be determined. Its apparent function, as a page carrying a well-known exchange's name, is a likely lookalike that could be used to collect credentials or wallet access.

Scam/Impersonation Risk

Contradictory signals are present and weigh heavily. The site is blacklisted by several independent threat-intelligence sources, including multiple leading security vendors that flag it as malicious. The hosting provider's own gateway has also flagged it as a suspected phishing destination. Two further facts reinforce this reading. The hostname pairs a prominent exchange brand with a random suffix on a free shared-hosting domain, a pattern commonly used for lookalike and credential-harvesting pages. The site's browser behaviour also shows heavy third-party request traffic, a high rate of console errors, and large page changes after interaction. No conflicting legal entities were found, because no identity content was available to compare. Brand impersonation was not conclusively established. The reputation and phishing evidence is nonetheless decisive, and the protective features that are present cannot offset it. Evidence:

• Homepage capture: a Cloudflare "Suspected Phishing" interstitial stating the site "has been reported for potential phishing", with no destination content.
• Reputation checks: a majority-weighted set of security engines returned malicious or suspicious verdicts, and the reputation kill-switch was triggered.
• Hostname: the exchange-branded name on a free pages-hosting subdomain is a lookalike pattern. Impersonation is not confirmed.
• Sandbox behaviour: high external-request share and repeated console errors across three runs.

Regulatory Verification Notes

The only page retrieved was the warning interstitial. No company name, legal terms, privacy policy, contact details, or licensing or registration claim from the operator is available, so the operator's real-world identity remains unverified. No third-party broker or regulatory-registry match was found. Registration and ownership details are incomplete and are treated as ownership opacity, not as an identity contradiction. A transport-encryption certificate is valid, but this is a baseline hygiene factor, and domain-validated certificates are freely available to any site, including malicious ones. Evidence:

• Served from AS13335 (Cloudflare, Inc., US).
• TLS certificate issued by WE1 (DV), valid to 2026-12-11, with about 50 days remaining.
• Homepage: no operator identity, license number, or legal entity is present in the captured content.

What to Verify Next

Anyone who encountered this address through a link, advertisement, or message should reach the genuine exchange only by typing its known official address manually or using an app from an official store, then compare it with how the link reached them. A user who has already entered a password, seed phrase, or API key should treat that credential as exposed. They should rotate it, enable hardware-based multi-factor authentication, and revoke any wallet approvals. The address should be reported to the exchange's official security team and to the hosting platform's abuse channel. Official support channels should be confirmed through the exchange's own verified website, not through anything reached from this address. Evidence:

• Warning page: the gateway identifies the site as reported for phishing, which supports abuse reporting.
• Hostname: the shared-hosting subdomain is not an official brand domain.
• Page capture: no login form was captured, so credential entry here was not directly observed.

Summary Verdict

The available evidence places this site in the highest-risk tier. Independent threat detections and a phishing warning are decisive, and neither legitimacy signals nor technical hygiene offset them. Its identity is unverified and no credible indication of a genuine operator exists. The site should be regarded as hostile until proven otherwise.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and web application firewall, and all observed addresses are edge servers, so the true origin server was not observable. This is a mitigating factor only. It shows the domain is professionally fronted and the hosting network carries no abuse history. It does not indicate legitimacy and does not outweigh the reputation findings, and it also prevents independent verification of where the content is actually served from.

Closing Assessment

Do not enter credentials, connect a cryptocurrency wallet, approve transactions, download files, or make any payment on this site. At most, treat any contact as read-only observation from a hardened, isolated environment. Anyone who has already interacted with it should act immediately to secure their accounts and assets.