Is boaclaim.pages.dev a scam? TrustSniffer's high-risk assessment: 18/100

Overview

This website is a single-page site published on a free subdomain of a public web-hosting platform. Its page title presents it under the name "BOSagora", and the domain name itself uses the word "claim". The homepage returned a short text page with no further identifiable content. Its apparent purpose is to present a claim-style or brand-themed landing page tied to a blockchain-related name. The capture shows no verified operator, product, or business model.

Scam/Impersonation Risk

This is a high-risk assessment with confirmed contradictory signals. The domain is blacklisted: multiple independent reputation sources flag it, with two engines returning malicious verdicts and two more returning suspicious ones. A broader external blacklist signal corroborates this. Two further factors raise the concern. The hostname pairs a claim-style keyword with a well-known blockchain brand name, a pattern typical of reward or token-claim lures. It also sits on a free, shared hosting subdomain, so the operator did not register a standalone domain. No explicit brand-impersonation or identity-conflict finding was confirmed, and the content analysis could not tie the site to any legitimate brand, so it cannot be treated as the brand's official property. Behavioral testing found no wallet-connection prompts, wallet-drainer activity, clipboard manipulation, hidden forms, or page cloaking. However, the page sent seven outbound POST requests, three of them to destinations outside the recognized-service set. That is a data-egress pattern worth caution on a site that already carries reputation flags. The page also made dozens of external background requests. Evidence:

• Homepage: the page title presents the site as "BOSagora" while the hostname is a free-platform subdomain containing "claim", with no verifiable link to the named brand.
• Reputation checks: two malicious and two suspicious detections, plus a corroborating external blacklist flag.
• Behavioral sandbox (three successful runs): 51 external XHR/fetch requests and 7 external POSTs, 3 of them to non-whitelisted destinations.
• Behavioral sandbox: no wallet-drainer, clipboard-hijack, hidden-form, or cloaking behavior detected.

Regulatory Verification Notes

The captured homepage discloses no company name, licence, registration number, or legal pages, and no real-world operator can be independently connected to it. The content analysis could not verify identity, so no claim of legitimacy can rest on the site's own presentation. No third-party broker or regulator record matched this site. The absence of one is not a finding in itself, but it leaves nothing that offsets the reputation flags. Registration details are incomplete, which fits the platform-subdomain model and is an ownership-opacity point rather than an identity contradiction. A valid certificate establishes only encrypted transport, not who operates the site. Evidence:

• Homepage: no operator name, licensing statement, or terms/privacy disclosures were found in the captured content.
• Transport encryption: TLS certificate issued by YE2 (DV, domain-validated only), valid to 2026-12-16.
• Hosting: served from AS13335 (Cloudflare, Inc., US).

What to Verify Next

Before any interaction, confirm through the official channels of the brand the name evokes (its verified website and announcements, reached independently, not via this page) whether any claim or reward program at this address exists. Treat the address as unrelated to that brand until the brand confirms it. Do not connect a wallet or enter credentials, seed phrases, or payment details. Re-check the address against current threat-intelligence listings before any further engagement. Confirm the official support and contact channels through an independent route. Evidence:

• Homepage: the brand-style title and claim-style hostname are the only identity cues, and neither can be validated from the site.
• Behavioral sandbox: outbound POSTs to unrecognized destinations indicate data may leave the visitor's browser to third parties.
• Reputation checks: current detections make an independent brand confirmation essential before any engagement.

Summary Verdict

The available evidence supports a clearly cautionary posture. Confirmed reputation detections and the absence of any verifiable operator or brand link outweigh the site's technically sound transport setup. Only passive viewing is consistent with the findings. Login, credential entry, and any financial interaction fall into the unsafe category.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and web-application firewall. All four observed addresses are CDN edge servers, and the origin host could not be seen. That is typical of shielded deployments and is mitigating for network-level exposure only. It also prevents independent verification of the actual hosting and allows content to change quickly behind a stable address. This protection does not offset the reputation detections or establish the site's legitimacy.

Closing Assessment

Treat the site as unsafe for any transactional or credential-based use. Limit contact to passive viewing, if any, and use the legitimate brand's independently confirmed channels for any real claim or program.