Is Pages a scam? TrustSniffer's high-risk assessment of br-7cr.pages.dev: 0/100

Security Alert

Fortinet, Google, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a recently created subdomain on a shared, free web-hosting platform, and it presents no usable business content to a visitor. The only page content captured was a security interstitial titled as a suspected-phishing warning, a short text block that gave the page no discernible product, brand or service. Its apparent purpose therefore cannot be established from the site itself, and the available evidence points to a disposable-style deployment rather than an operating business.

Scam/Impersonation Risk

Contradictory signals are present and decisive. The site is blacklisted by multiple independent reputation sources: a major safe-browsing service classifies it under a social-engineering threat type, and a substantial group of security engines, including several top-tier vendors, flag it as malicious. A protective kill-switch on external reputation was triggered, so no amount of favorable technical hygiene can offset it. The interstitial the homepage returned is itself consistent with those findings, because the platform's own security layer labels the destination a suspected phishing site. No conflicting legal entities or brand-impersonation targets could be identified, since no identity content was captured. This is a reputational and threat-intelligence conclusion, not a finding about a named operator. The behavioral sandbox gave a mixed picture. It found no wallet-connect prompts, clipboard manipulation, hidden forms or externally posted password forms. It did record heavy third-party request traffic, repeated outbound POST activity and a high rate of script errors, which is inconsistent with a simple static page. No contact artifacts were extracted. Evidence:

• Homepage: capture was met by a bot challenge (HTTP 403) showing a "Suspected Phishing" interstitial, with only a short block of text.
• Reputation: flagged malicious by 13 security engines (plus 2 suspicious), including Fortinet, Google, Kaspersky and Sophos; Safe Browsing threat type SOCIAL_ENGINEERING.
• Provenance: domain age ~88 days; 1 archive snapshot (2026-08-02), 1 year tracked, so there is no meaningful history.
• Sandbox: 3 of 3 runs completed; 19 external XHR/fetch calls and 5 external POSTs (none to unrecognized destinations); 18 console errors; no wallet, clipboard or credential-exfiltration behavior.

Regulatory Verification Notes

No legal, terms, privacy or about pages were available for assessment, because the captured page was a platform warning rather than operator content. There is therefore no licensing, registration or corporate-identity claim to evaluate, and none can be credited. A third-party broker-reputation dataset returned no match for this site, which is neutral. The reputational evidence above is what governs the assessment here, not any regulatory finding. The site's transport encryption is valid, but it is a basic domain-validated certificate that proves only that the connection is encrypted, not that the operator is legitimate. Evidence:

• Transport security: TLS certificate issued by WE1 (DV), valid to 2026-12-20.
• Hosting: served from AS13335 (CLOUDFLARENET, Cloudflare, Inc., US).
• Identity: no operator name, address, registration number or regulator reference was present in the captured content.

What to Verify Next

Anyone who was sent to this address, for example through a message, advertisement or social-media link, should treat the referral channel as suspect and confirm the sender's identity by an independent, offline route. If the intended counterparty is a known organization, its official address should be obtained from a trusted source such as printed material, an established directory or a prior verified relationship, and not from this link. A person who controls this deployment should check it for unauthorized changes and for files that may have been uploaded or altered. Such a person should also request a security re-review after any remediation. The hosting platform's abuse channel is the appropriate route for reporting suspected misuse. Evidence:

• Reputation: the current malicious classification is the trigger for these steps.
• Homepage: the platform warning replaced all site content, so no on-site contact route could be assessed.
• Provenance: the very recent creation and single archive capture provide no track record to rely on.

Summary Verdict

The overall posture is high-risk. Strong, converging threat-intelligence detections from major security sources outweigh the site's technically clean transport and behavioral hygiene, and the lack of any visible operator, history or substantive content gives nothing to counterbalance them. The site cannot be treated as trustworthy in its current state, and its real-world operator remains unidentified.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and WAF, and all four observed addresses are edge servers, so the origin host was not observable. The platform's bot protection is also active, which is why content capture was challenged. This is a mitigating factor for resilience only. It does not establish legitimacy, and it cannot offset the reputation findings. The shared edge also limits independent confirmation of where the content is actually hosted.

Closing Assessment

Interaction should be limited to, at most, passive viewing, with no login, no credential or personal-data entry, no payment or wallet activity, and no file downloads. Any link or request that led here should be disregarded until the sender is confirmed through a separate channel.