Is blockdags-ef6.pages.dev a scam? TrustSniffer's high-risk assessment: 5/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This is a web page served from a free-tier shared hosting subdomain whose name evokes a cryptocurrency project in the "BlockDAG" style. When the page was captured, what loaded was a hosting-provider interstitial headed "Suspected Phishing" rather than a branded product or marketing page. Only a few hundred characters of text were present. The site's apparent purpose is crypto-themed promotion or onboarding, but no products, claims, or operator details could be read from the captured content.

Scam/Impersonation Risk

This is a high-risk site. It is confirmed as blacklisted by multiple independent security sources. A substantial cluster of detection engines flag it as malicious, including several tier-one vendors, and this is decisive for the assessment. The hosting platform's own warning page, labelled as a suspected phishing site, corroborates it. The hostname imitates a crypto-project brand and sits on a generic shared-hosting parent domain. That pattern is typical of disposable lookalike pages built to harvest wallet or account credentials, although no formal brand-impersonation finding or legal-identity conflict was recorded. No wallet-connection prompts, clipboard manipulation, hidden forms, or credential posts to third-party hosts were observed in the behavioural runs. The page did show heavy external request activity and a high rate of script errors, so the absence of those behaviours should not be read as reassurance. The detection record alone makes credential entry, wallet connection, and any payment unsafe. Evidence:

• Homepage capture: a bot-challenge interstitial titled as a suspected phishing page, returned with an access-denied status.
• Reputation checks: 14 engines rated the domain malicious and 1 suspicious, including three tier-one vendors.
• Behavioural sandbox on the homepage: 19 external fetch requests and 5 external POSTs, all to allow-listed destinations, with 15 console errors.
• Provenance: the domain is ~2.3 years old, with 13 archive snapshots spanning 2024–2025 (2 years tracked). This is a young, thinly documented footprint.

Regulatory Verification Notes

No legal, terms, privacy, or about pages could be reviewed, because the captured content was only the interstitial. The site therefore gives no basis for linking it to a licensed or registered entity, and its connection to any real-world brand or operator remains unestablished. The ownership and governance picture is opaque. The technical hygiene signals are real but carry little weight here. A valid certificate and a recognised network provider are routine for disposable pages and do not offset a confirmed blacklist. No third-party broker or regulator record matched this site, so there is no external regulatory context either way. Evidence:

• Legal and identity pages: none accessible in the captured content, so no company name, licence, or registration number could be assessed.
• Hosting: served from AS13335 (Cloudflare, Inc., US).
• Transport encryption: TLS certificate issued by WE1 (DV, domain-validated only), valid to 2026-12-16. DV confirms domain control, not operator identity.
• Crypto recognition: the domain is not listed in the DeFi protocol directory checked, so no recognised protocol is behind the name.

What to Verify Next

Before any engagement, anyone who believes they were directed here by a legitimate crypto project should confirm that project's official domain through an independent route, such as the project's established social channels or a trusted exchange listing. They should compare it character by character with this hostname. Official contact and support channels should likewise be confirmed independently, not through links or messages that led to this page. Anyone who has already interacted with the page should review wallet approvals and rotate any reused passwords. Reporting the page to the hosting platform and to phishing-reporting services would help remove it. Evidence:

• Homepage: the hosting provider's own suspected-phishing warning is the strongest pointer to treat this hostname as untrusted.
• Parent domain: the page sits on a shared-hosting subdomain that anyone can register, so the hostname alone gives no proof of brand ownership.
• Reputation record: the blacklist listing is current, so any prior familiarity with the name should not be treated as validation.

Summary Verdict

The overall posture is clearly cautionary. Confirmed multi-source security detections, a hosting-platform phishing warning, and an unestablished operator identity converge on an elevated-risk assessment. Technical hygiene does not change that conclusion.

Infrastructure Integrity

The site is fronted by Cloudflare's CDN and WAF, and all four observed addresses are edge nodes on the Cloudflare network. The origin server was not observable, so the hosting location behind the edge cannot be independently confirmed. The edge-only view limits independent verification of where content is actually served from. This protective infrastructure is a mitigating factor only. It does not offset the reputation findings and is not evidence of legitimacy.

Closing Assessment

Do not enter credentials, connect a wallet, make payments, or download anything from this site. At most, treat it as read-only material for investigation from an isolated environment. Report it and reach the genuine project only through independently confirmed official channels.