Is claim-something.pages.dev a scam? TrustSniffer's high-risk assessment: 5/100

Overview

This is a single-page website titled "KIMCHI | Airdrop". It is hosted on a free, shared subdomain of a developer page-hosting platform rather than on a standalone branded domain. It presents itself as a token airdrop landing page, apparently inviting visitors to claim a distribution of a token called KIMCHI. Its apparent purpose is to steer visitors toward a claim or participation action under a crypto-giveaway theme.

Scam/Impersonation Risk

The site carries a confirmed blacklist listing. Several major threat-intelligence engines independently classify it as malicious, and a separate external blacklist source corroborates this. That convergence is the decisive factor in this assessment. No conflicting legal identities and no brand impersonation were observed, so the risk does not come from identity contradictions. It comes from the reputation listing, which sits on a page whose theme is a "claim" or airdrop. This format is widely used for token-claim lures, and such lures typically try to get visitors to connect a wallet or approve a transaction. The automated browser sessions did not observe wallet prompts, outbound data submissions, hidden forms, clipboard manipulation, or cloaking, and this is the only mitigating behavioural observation. A claim page can still change after a scan. The site is also very new and has almost no history, which fits a short-lived campaign page. Its content could not be independently analysed, so what the site actually asks visitors to do remains unconfirmed. Evidence:

• Homepage: the page title presents a KIMCHI airdrop, a claim-style offer with no visible operator branding in the captured material.
• Reputation: multiple threat-intelligence engines flag the site as malicious, and an external blacklist source confirms the listing.
• Provenance: domain age is about 0.33 years (~119 days), with a single archive snapshot dated 2026-07-04 (1 year tracked).
• Behaviour: three successful sandbox runs showed no external requests, no wallet-provider detection, no hidden forms, and no cloaking.

Regulatory Verification Notes

No legal, terms, privacy, or about pages were identified, and the captured material names no operating company, registration number, or licence. The site's real-world operator therefore remains independently unverified. Ownership and governance are opaque. The site runs on a shared platform subdomain, so there is no standalone registrant record to anchor an identity. An airdrop or token distribution that invites participation normally warrants a named issuer, published token terms, and a disclosed legal entity, and none is present. Against the reputation listing above, this missing disclosure reinforces caution. No third-party broker or regulatory-database match exists for this site, so there is no external regulatory context either way. Evidence:

• Homepage: no company name, licence, registration number, or token terms were observed.
• Hosting: served from AS13335 (Cloudflare, Inc., US).
• Transport security: TLS certificate issued by WE1 (DV, domain-validated only), valid to 2027-01-20.
• Broker datasets: no match was found for this site in third-party broker intelligence.

What to Verify Next

Any claim that a KIMCHI token or airdrop is real should be confirmed only through the token project's officially published channels, reached independently of this page, such as a documented website or announcement from a known team. If no independent confirmation exists, the offer should be treated as unsubstantiated. Anyone who has already interacted with the page should check whether any wallet connection or token approval was granted and revoke it through a reputable approvals-management tool. They should also confirm that no seed phrase, private key, or credential was entered. The official support or contact channels of the claimed project should be confirmed through an independent route. Evidence:

• Homepage: the airdrop claim cannot be tied to an identifiable issuer from the captured material.
• Threat listing: the active malicious classification should be re-checked against current reputation sources before any reconsideration.
• Access path: the page is on a free shared subdomain, so a legitimate project would be expected to publish a branded domain.

Summary Verdict

The overall posture is high-risk. The decisive consideration is the active malicious classification from independent threat-intelligence sources, set against a very young, thinly documented, anonymous page. Technical hygiene such as valid encryption and clean sandbox behaviour does not offset that classification. Legitimacy is not supported, and the site's operator identity remains unverified.

Infrastructure Integrity

The site is delivered through Cloudflare's CDN and WAF, and all observed addresses are CDN edge nodes. The origin server is not observable, which prevents independent hosting verification and can mask rapid content swaps. The DNS profile shows short-lived, fast-flux-like characteristics, and this is only an unconfirmed heuristic. Protective infrastructure and a valid certificate here are mitigating factors only. They say nothing about the operator's intent, and they cannot offset the threat-intelligence listing.

Closing Assessment

The page should be treated as unsafe for any sensitive interaction. That means no wallet connections, signing requests, token approvals, credential or seed-phrase entry, or payments. Passive viewing in an isolated environment is the only proportionate use. Any exposure should be reported to the platform host and to the organisation's security team.