Is cashcat-claim.pages.dev a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a subdomain hosted on a free web-publishing platform, and its name suggests a "claim"-style reward or giveaway offer. When captured, it displayed only a security interstitial warning that the address had been reported for suspected phishing. The underlying product, pricing and revenue model could not be observed, and the site's apparent purpose is unconfirmed.

Scam/Impersonation Risk

This site shows confirmed adverse contradictions. Multiple major security vendors currently flag the domain as malicious, and it is blacklisted by external reputation sources. The hosting platform's own protective layer also placed a suspected-phishing warning in front of the content, so a visitor cannot reach the underlying page without passing that block. Separately, the domain's name closely resembles its hosting platform's own domain, which raises a brand-lookalike concern. The name's "claim" wording is also consistent with a reward-claim lure, though no page content was available to confirm this. The captured warning page itself requested no credentials or payments, contained no forms, and showed no wallet or clipboard manipulation. That reflects the interstitial and says nothing reassuring about the blocked site behind it. Behavioural testing recorded a very large number of page-structure changes after interaction and repeated script errors, which is consistent with an application that swaps content dynamically. No conflicting legal entities were observed, because no legal identity was available to compare. Evidence:

• Homepage capture: a security warning stating the site "has been reported for potential phishing", with no first-party content, products or contact channels visible.
• Reputation checks: 19 security engines flagged the domain as malicious, including three leading endpoint-security vendors, and the external blacklist kill-switch was triggered.
• Homepage behaviour: 1,508 DOM mutations after interaction and 13 console errors across 3 sandbox runs. No hidden forms and no wallet-connect activity were detected.
• Domain pattern: a strong lookalike similarity to the hosting platform's own domain.

Regulatory Verification Notes

No licence, registration number, company name or legal page was observable, because the capture contained only the warning interstitial. The real-world operator is therefore unidentified, and the identity of the party behind the site is unverified. No third-party broker or regulatory-database match was found. The adverse reputation findings above are the material concern here, not the absence of a licence. The site cannot be treated as a regulated or accountable counterparty for any financial, onboarding or payment purpose. Evidence:

• Homepage capture: no legal entity, licence, terms, privacy or about content is present.
• Broker reputation lookup: no matching profile, so there is no third-party reputational context to offset the threat findings.
• Hosting: served from AS13335 (Cloudflare, Inc., US).
• Transport encryption: TLS certificate issued by YE1 (DV), valid to 2026-12-18. A DV certificate confirms only control of the domain, not the operator's identity.

What to Verify Next

Anyone who received this address in a message, advertisement or social post should treat the sender as the thing to investigate. They should check through an independent route whether the claimed brand or programme actually operates a reward or claim offer, using only addresses obtained from that organisation's known official channels. Any contact channel for the claimed brand should be confirmed independently, not through details supplied alongside this link. If the link arrived unsolicited, it should be reported to the sender's platform and to the hosting platform's abuse process. Users who have already visited the site and entered anything should change any reused passwords and monitor their accounts. Evidence:

• Homepage capture: the only observable content is the phishing warning, so no on-site claim can be corroborated.
• Domain naming: the "claim" wording and the lookalike of the hosting platform's domain are unverified lure indicators and need independent confirmation of origin.
• Site profile: no official brand, publisher or support channel is identified anywhere in the captured material.

Summary Verdict

The overall posture is high risk with a decisive adverse reputation. Independent security vendors and the hosting platform's own protection both flag the domain for phishing, the operator is unidentified, and no first-party content exists to counter those findings. Technical hygiene such as valid encryption is outweighed by the confirmed threat detections.

Infrastructure Integrity

The site is served through Cloudflare's CDN and WAF, and all four observed addresses are shared edge nodes in the same network. The origin server was not observable. This shows ordinary, reputable platform hosting and the site's transport encryption is valid. It is only a mitigating factor and does not offset the reputation findings, because shared platforms host both legitimate and abusive sites. The edge-only visibility also means the underlying hosting cannot be independently verified.

Closing Assessment

The site should not be used for login, credential entry, wallet connection, payments or any financial interaction. Links to it should not be opened or forwarded, and any request to "claim" something through it should be treated as hostile until the claimed brand confirms it through its own official channels.