Is bitcoininu.pages.dev a scam? TrustSniffer's high-risk assessment: 23/100

Security Alert

Fortinet flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

The site at bitcoininu.pages.dev is a cryptocurrency-themed web property. It runs on a subdomain of a shared web-publishing platform, not on a domain of its own. Its name evokes a Bitcoin-branded meme token. When it was visited, the only content returned was a short hosting-platform interstitial titled "Suspected Phishing", with no product pages or business description behind it. The intended purpose therefore cannot be established beyond the token-style branding. That branding, together with the warning page, matches the profile of a token-promotion or onboarding front end.

Scam/Impersonation Risk

Contradictory signals are present, and they are severe. The site is blacklisted by external threat-intelligence sources. Several independent security engines classify it as malicious, and at least one major security vendor flags it. A further engine rates it suspicious. The hosting platform's own interstitial labels the page as suspected phishing, and the site's archive history carries a known-phishing marker. The domain also closely resembles the shared platform domain it is hosted under, which fits a lookalike or subdomain-abuse pattern. In sandbox runs the page showed heavy external traffic, with almost all requests going to third-party hosts. Runs also recorded a large burst of DOM changes after interaction and repeated console errors. The sandbox did not observe wallet-connection prompts, wallet-drainer behaviour, clipboard tampering, hidden forms, or credential posts to outside hosts. That reduces, but does not remove, the concern, because the page was shielded by a bot challenge and its full functionality was never exposed to the analysis. No conflicting legal identities were found, and no explicit brand impersonation was confirmed. Evidence:

• Homepage: the captured page title was a suspected-phishing warning, and the capture was blocked with a 403 bot challenge.
• Reputation: 3 engines rated the site malicious and 1 suspicious, with a major vendor among the detections. The external blacklist flag is active.
• Sandbox behaviour (3 of 3 runs completed): 83 external XHR/fetch requests, with up to 97.1% of requests going to external hosts, 1,508 DOM mutations after interaction and 12 console errors. 0 wallet-connect, drainer or clipboard events.
• Provenance: the domain is about 1.8 years old, with 6 archive snapshots spanning 2024–2025 (2 years tracked). The archive carries a phishing-known marker.

Regulatory Verification Notes

No regulator, licensing body or financial-services registry lists this site, and no third-party broker-reputation record matched it. The only page content recovered was the warning interstitial. There were therefore no legal, terms, privacy or about pages to assess for a named entity, registration number or licence. The real-world operator has not been independently identified. A site with token-style branding that offers no verifiable corporate or regulatory anchor, and that is flagged by external sources, should not be treated as a regulated or accountable counterparty. Nothing here supports any claim of authorisation to handle funds or digital assets. Evidence:

• Homepage: the retrievable text was about 381 characters, consisting of the interstitial notice and no business, legal or licensing content.
• Third-party registries: no regulated-entity reference and no broker-database match were found for the site's name.
• Hosting and encryption: served from AS13335 (Cloudflare, US). The TLS certificate was issued by WE1 (DV), valid to 2027-01-07 (73 days remaining), which establishes encryption only and says nothing about operator identity.

What to Verify Next

Before any engagement, the first step is to establish who operates the site and whether it is genuinely linked to any named token or project. Check the project's official channels through an independent, offline route, such as a known-good project announcement or a verified exchange listing. Do not use links supplied by the site itself. Confirm that this address is the officially published one for that project, since the lookalike structure and the warning interstitial both point to possible impersonation. Check the current status of the hosting platform's warning and the external detections. Any claim of licensing or authorisation should be checked against the relevant financial-regulator register directly. If the site is the property of a legitimate project, its owner should be contacted through the project's established channels, as a compromise of the page is also possible. Evidence:

• Homepage: the platform-issued suspected-phishing notice is the first item to be cleared before any engagement.
• Reputation: multiple current malicious detections remain unresolved.
• Domain structure: the address is a subdomain of a shared publishing domain that closely mimics that domain's name, so ownership cannot be inferred from the address alone.

Summary Verdict

The overall posture is high-risk. Confirmed blacklisting, a platform phishing warning and multiple malicious detections together override the technically valid encryption and reputable hosting. Identity is unverified and the commercial purpose is unknown, so there is no countervailing evidence of legitimacy. The site should be regarded as a probable phishing or fraud vector until proven otherwise.

Infrastructure Integrity

The site is served exclusively through Cloudflare's CDN/WAF, with every observed address belonging to Cloudflare edge servers in the US and no origin address visible. Bot-challenge protection was active. These protections and the valid DV certificate are mitigating factors only. They cannot offset the external threat detections and say nothing about the operator's intent. Edge-only visibility also prevents independent verification of where the content is hosted and allows content to be swapped quickly.

Closing Assessment

The site should not be used for login, wallet connection, credential entry, or any payment or transfer of funds or digital assets. Any browsing should be strictly read-only and ideally done from an isolated environment. If it was already visited or any details were submitted, passwords should be changed and wallet approvals reviewed and revoked.