Is claim-wish.pages.dev a scam? TrustSniffer's high-risk assessment: 5/100

Security Alert

Fortinet, Google, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a single-page "airdrop" claim portal titled "Token_Symbol | Airdrop", hosted on a subdomain of a free, shared static-site hosting platform rather than on a standalone branded domain. It presents a short block of text inviting visitors to claim a token allocation, and it uses a placeholder token name. Its apparent purpose is to draw visitors into a token-claim flow that typically ends in wallet connection or credential and payment submission.

Scam/Impersonation Risk

Confirmed adverse reputation signals converge on this site, so it must be treated as a high-risk, likely social-engineering lure. Major browser-protection and threat-intelligence sources currently flag the address, and the browser-safety classification is specifically social engineering, meaning deceptive content that tricks visitors into disclosing credentials or authorising transactions. Multiple independent security engines independently rate the page malicious, including several top-tier vendors, and the address is already recorded as a known phishing destination. The structure of the site matches the pattern of such lures. It is a freshly created subdomain on a free hosting platform that closely resembles that platform's own name. The only page carries a placeholder token title with "claim" and "airdrop" framing, which creates urgency and the expectation of free value. Automated behavioural testing of the page did not observe wallet-connection prompts, clipboard tampering, hidden forms or external credential posts. That is not reassuring, because lure pages often activate their harmful step only after a visitor takes a deliberate action, or are swapped out quickly on disposable hosting. No conflicting legal-entity names were found, but the confirmed threat listings are sufficient on their own to establish a serious risk of fraud. Evidence:

• Homepage: the page title is a placeholder, "Token_Symbol | Airdrop", and the text promotes an airdrop claim with no named project, product or team.
• Reputation checks: 14 engines flagged the site as malicious and 2 as suspicious, and the browser-safety classification is social engineering.
• Domain provenance: the domain is about 0.5 years old, with 4 archive snapshots spanning 2026-04-30 to 2026-07-04, a short and thin record consistent with a disposable deployment.
• Homepage behaviour: three test runs returned stable responses with no console errors and no wallet-provider activity, so no harmful action was triggered during testing.

Regulatory Verification Notes

The site claims no regulated status, and no third-party regulatory or broker-reputation record is associated with it. The captured page contains only a short block of promotional text. It publishes no identifiable operating company, licence, registration number, terms of service or privacy policy. For a site inviting visitors to claim digital assets, that is a content gap, and it removes any basis for treating the offer as a lawful or supervised activity. Confirmed security listings outweigh the technically valid transport security on the site. A domain-validated certificate shows only that the domain was controlled when the certificate was issued, and it says nothing about the operator's identity or intent. Evidence:

• Homepage: no company name, licence, registry reference or legal pages appear in the captured content.
• Transport encryption: the TLS certificate was issued by YE2 at domain-validation (DV) level and is valid to 2027-01-23.
• Hosting: the site is served from AS13335 (Cloudflare, Inc., US).

What to Verify Next

Nothing on this site should be relied on for any decision involving assets or personal data. Anyone who received a link to it should trace the offer back to the project it claims to represent, using that project's official website and social accounts reached independently of the link. Any airdrop should be treated as unverified until the named project itself confirms it through its own channels. Anyone who has already visited the page and interacted with it should review wallet connections and token approvals, revoke any that are unfamiliar, and change credentials entered there. Organisations should report the address to their security team and to the hosting platform's abuse process. Official support or contact channels should be confirmed only through independent, offline routes. Evidence:

• Homepage: the airdrop offer names no verifiable issuer, so confirmation must come from outside the site.
• Reputation checks: active browser-safety and multi-engine detections mean the address should be blocked or quarantined pending takedown.
• Domain provenance: the domain's recent creation (first archive capture 2026-04-30) leaves no long operating history to lend credibility to the claim.

Summary Verdict

Available evidence supports an elevated-risk, clearly adverse assessment. Active threat listings from several independent sources, together with a young, disposable deployment profile and a lure-style offer, outweigh the technically sound but non-probative aspects of the site. Its real-world operator is not independently identified, and the evidence does not support treating it as a legitimate service.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and WAF, and every observed address is a Cloudflare edge address. The origin server was not observable, so independent verification of the underlying host is not possible. This also allows content to be changed quickly without any visible change in infrastructure. Protective infrastructure is a mitigating factor only here. It has no bearing on the content served, and it cannot offset the confirmed reputation risk.

Closing Assessment

The site should not be used for login, credential entry, wallet connection or any financial interaction, and nothing should be downloaded from it. Viewing it is the only low-risk use, and then only from an isolated, non-sensitive environment. It should be blocked in organisational controls until the threat listings are cleared.