Is claim-one.pages.dev safe? TrustSniffer's low-trust assessment: 42/100

Overview

This website is a single-page "One | Airdrop" site on a free subdomain of a shared developer-hosting platform. It presents a token-airdrop claim experience, apparently to attract visitors to claim a crypto distribution. Its page carries little text, and the capture shows no operator, team or product documentation. The apparent purpose is airdrop-style user acquisition, a model that is commonly abused for wallet and credential harvesting.

Scam/Impersonation Risk

The domain is blacklisted. Several independent security engines classify it as malicious and another rates it suspicious, and an additional external blacklist signal corroborates this. That concentration of third-party detections outweighs the site's otherwise tidy technical presentation. The reputational detections carry the most weight here. Conflicting legal identities and confirmed brand impersonation were not observed, so the elevated risk rests on the blacklisting and not on identity inconsistency. The airdrop framing deserves particular scrutiny. Claim-your-tokens pages are a standard lure for wallet-drainer and approval-phishing schemes, and the fresh, throwaway-style subdomain fits that pattern. The automated behavioral sandbox did not observe wallet-connection prompts, clipboard tampering, hidden forms, cloaking or traffic to external hosts. That reflects the homepage as captured and does not rule out malicious behavior being served later or after a deliberate user action. This is a mitigating observation only and does not override the blacklisting. Evidence:

• Homepage: titled "One | Airdrop", with a short text body and no identifiable operator or project documentation.
• Domain provenance: first registration is about 119 days old (~0.33 years), and the web archive holds a single snapshot, first and last seen 2026-07-04.
• Reputation: 3 security engines flag the domain as malicious and 1 as suspicious.
• Sandbox: 3 of 3 runs completed with HTTP 200 and no external requests, wallet-connection activity or console errors.

Regulatory Verification Notes

The captured page offers no licensing details, registered entity or legal terms that could be assessed. No regulator, registry or third-party broker record was matched to this site, so no reputational or regulatory standing can be inferred from outside sources. Ownership opacity applies. Registration details are incomplete, which limits independent attribution of the operator. That is an administrative limitation and is not evidence of identity contradiction. Real-world identity is unverified, and nothing on the page can be treated as proof of a legitimate issuer. The transport encryption is valid but is a basic domain-validated certificate, so it only confirms an encrypted connection and says nothing about who operates the site. Evidence:

• Homepage: no company name, licence number, jurisdiction or legal-terms content identified in the captured text.
• Transport security: the TLS certificate was issued by WE1 (DV validation) and is valid to 2027-01-17.
• Hosting: served from AS13335 (Cloudflare, Inc., US).

What to Verify Next

Any claim to an airdrop should be traced to an announcement made by the token project itself, through its officially documented website, social accounts or exchange communications. These should be reached independently and not through this page. The claimed token and its contract should be checked on a public block explorer for a real issuer, history and holder base. The official contact channels of the supposed project should be confirmed offline or through an independent route. Any wallet approval or signature request should be treated as untrusted until this verification is complete. Evidence:

• Homepage: the airdrop claim names no verifiable issuer, token contract or official channel to check against.
• Domain: a very young subdomain on a shared platform offers no established brand footprint to cross-reference.
• Reputation: the existing blacklisting means independent confirmation must precede any interaction.

Summary Verdict

Overall posture is high-risk and clearly cautionary. Confirmed third-party blacklisting and the site's very recent, thinly documented origin outweigh its clean technical hygiene. The evidence does not support treating this as a legitimate, trustworthy destination for sensitive interaction.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and WAF, and every observed address is a CDN edge node. The origin server could not be observed, which prevents independent hosting verification and can mask rapid content swaps. The protection and the valid hosting footprint are mitigating factors only. They reduce the likelihood of simple technical compromise but do not offset the external threat detections or establish the operator's legitimacy.

Closing Assessment

The site should not be used for logging in, connecting a wallet, signing transactions, submitting credentials or any financial interaction. Passive viewing is the only reasonable use, and it should take place in an isolated, non-production browser profile. Anyone who has already interacted with it should review and revoke wallet approvals and change any exposed credentials.