Is Pages a scam? TrustSniffer's high-risk assessment of bsssb.pages.dev: 5/100

Security Alert

Fortinet flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

The website is a subdomain on a shared static-hosting platform, not an independently registered brand domain. Its homepage could not be retrieved in ordinary form. Automated capture returned a protective interstitial headed "Suspected Phishing", and only a short fragment of text was available. No products, services, or business model are presented to the visitor, so the site's purpose cannot be established from its own content.

Scam/Impersonation Risk

This is the decisive section. The site carries confirmed third-party threat listings. Several independent reputation sources flag the domain as malicious or suspicious, including a major security vendor, and the site is blacklisted on that basis. The interstitial the platform returned in place of the homepage describes the site as suspected phishing. That is consistent with these listings and is a separate, visible warning that bears on the site's safety. The hostname closely resembles the shared platform's own domain, which is typical of throwaway deployments. Sandbox testing of the page found no wallet-connection attempts, no clipboard manipulation, no hidden forms, and no credential posts to outside hosts. These checks do not offset the listings, because the real page content was gated and the behaviour observed may not represent what a normal visitor would receive. The page also made a large volume of requests to outside services, mostly background fetches and a handful of data submissions. It logged a high number of script errors, which suggests an unstable or hastily assembled front end. No conflicting legal identities were found, and no named brand is being impersonated on the pages that could be read. The risk therefore rests on the reputation findings and on the unusual loading behaviour. Evidence:

• Homepage: automated capture received an access-challenge response whose title identifies the page as suspected phishing; only about 381 characters of text were obtained.
• Domain provenance: the domain is about 2.15 years old, with 15 web-archive snapshots spanning 2024–2026 (3 years tracked), a thin and very young record.
• Behavioural testing (3 runs): 19 external background requests and 5 external data submissions, with most traffic going to third-party hosts, and 18 console errors recorded.
• Threat-intelligence results: 3 engines rated the domain malicious and 2 suspicious, with one top-tier security vendor among the flaggers.

Regulatory Verification Notes

No legal, terms, privacy, or about content could be read, so no company name, licence, or registration number can be assessed. The site discloses no regulated status, and no regulator or third-party broker dataset links it to a licensed entity. That absence is not itself proof of wrongdoing, but with the threat listings it leaves the operator's real-world identity wholly unconnected to any accountable organisation. The site's hosting identity is that of the shared platform, not of any business. The registration record for the hostname is incomplete, so ownership is opaque. Evidence:

• Hosting: served from AS13335 (Cloudflare, Inc., US).
• Transport encryption: TLS certificate issued by WE1 at domain-validation level only, valid to 2027-01-09. This confirms an encrypted connection but nothing about who runs the site.
• Legal and identity pages: none were retrievable, so no entity name or licence reference was available to check.

What to Verify Next

Before any interaction, confirm independently whether the deployment is still flagged by the hosting platform's abuse process and by public threat-intelligence services. If the site claims to be a known organisation, locate that organisation's official domain through an independent route, such as a regulator's register, a printed statement, or a known-good search, and compare it with this address. Confirm the official support and contact channels the same way, not through links found on this site. Anyone who arrived through an unsolicited message, advertisement, or social-media link should treat that source as suspect and report it. Evidence:

• Homepage: the platform interstitial gives no operator information, so the legitimacy claim has no on-site anchor to check.
• Hostname: the name closely resembles the hosting platform's domain, which makes reliance on the visible address misleading.
• Absence of any retrievable legal or contact page means all verification must come from outside the site.

Summary Verdict

The site presents an elevated, clearly cautionary trust posture. Confirmed adverse reputation findings and a platform-level phishing warning outweigh every neutral or protective signal, and no independent evidence supports legitimate operation. The site is unsuitable for any sensitive or transactional use.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and WAF, and every observed address across the several edge IPs belongs to the Cloudflare network. The origin server is not observable, which prevents independent verification of where content is actually hosted. The valid certificate, bot-protection layer, and reputable network provider are mitigating factors only. They are generic to any site on the shared platform, confirm nothing about the operator, and cannot offset the reputation findings.

Closing Assessment

Do not enter credentials, connect wallets, make payments, or download files from this site. Limit any contact to non-interactive viewing, and only if essential. Anyone who has already submitted information should change affected passwords and report the address to the relevant platform and security authorities.