Is cryptoman-whitebit-pay.pages.dev safe? TrustSniffer's moderate-trust assessment: 60/100

Overview

This website is a single-page, crypto-themed payment landing page titled "Cryptomannn | Whitepay". It is served from a free subdomain on a shared developer hosting platform, and its hostname combines the name of a well-known cryptocurrency exchange with the word "pay". The captured homepage carries very little text, and automated capture was met by a bot challenge. No products, rates or fees could be extracted, so its apparent purpose is to look like a crypto payment or exchange-branded gateway. Whether it operates as a genuine service cannot be established from the observed content.

Scam/Impersonation Risk

A confirmed external blacklist hit is the decisive contradiction here. At least one reputation source currently flags the domain as malicious and another as suspicious, and the remaining sources do not offset this. The hostname pairs an established exchange brand with a payment label on a free, publicly provisioned subdomain, and the page title uses a near-variant of a payment brand. Together these form a classic brand-lookalike pattern. Structured analysis also rates the hostname as a close lookalike of the shared hosting platform's own domain. No conflicting legal entities were observed, so there is no identity contradiction. There is also no evidence of a wallet-connection prompt, clipboard manipulation, hidden forms, external password submission or content cloaking. These are the mechanisms typically used to drain funds, and their absence is a real mitigating observation. However, the page generated a heavy volume of outbound requests, including many outbound POST submissions. Roughly three-quarters of its network activity went to third-party destinations, and a high count of browser console errors suggests an unstable or templated build. Because the page's content was gated and thin, the sandbox may have missed credential or payment flows that appear after onboarding. The blacklist hit and the brand-adjacent naming make this site unsuitable for any sensitive interaction. This is a cautionary finding about reputation and presentation, not proof that the operator is a scammer. Evidence:

• Homepage and hostname: the domain name embeds a recognised exchange brand plus "pay" on a free shared-hosting subdomain, and the page title reads "Cryptomannn | Whitepay".
• Domain provenance: first observed in August 2024, about 2.2 years of registration continuity. The web archive holds 11 snapshots spanning 2024–2026 (3 years tracked), so the site is relatively young and thinly archived.
• Behavioural sandbox (3 of 3 runs completed): 22 outbound XHR/fetch calls and 20 outbound POSTs, none to non-whitelisted destinations. 66 console errors were recorded, with no wallet, clipboard or hidden-form activity.
• Reputation sources: one malicious and one suspicious detection against a majority of harmless or undetected verdicts, with no Safe Browsing-style flag.

Regulatory Verification Notes

The captured homepage names no operator, legal entity, registration number or licence, and no legal, terms or about pages were retrievable. For a site presenting itself as a crypto payment or exchange-style service, that is a disclosure gap. Ownership opacity applies, and the identity of the party behind the site has not been independently established. This is a verification matter, not by itself evidence of fraud, but it removes any basis for treating the site as a regulated or authorised provider. No third-party broker or regulator listing matched the domain, so no external reputational context is available either way. Transport security is valid but is domain-validated only, so it confirms an encrypted connection and nothing about who runs the site. Evidence:

• Homepage: roughly 378 characters of text, with no company name, licence, registration number or jurisdiction.
• Regulatory and broker datasets returned no match for the domain or its name.
• Transport security: TLS certificate issued by WE1 (DV, domain-validated only), valid to 2026-12-14, with about 52 days remaining.
• Hosting: served from AS13335 (Cloudflare, Inc., US).

What to Verify Next

Before any engagement, confirm through the official website of the exchange whose name appears in the hostname that it operates or endorses this payment page. Do this by navigating there independently, not through any link, QR code or message that led to this site. Check whether the exchange publishes a list of its official domains and whether this hostname appears on it. Search the relevant financial regulator's public register for any named operator or licence if one is later disclosed. Confirm official support and contact channels through an independent, offline route. Until these checks succeed, no wallet, credentials or funds should be committed. Evidence:

• Homepage and hostname: the brand-adjacent naming is the primary item to reconcile with the brand owner.
• Pages: no operator or licence reference was published to check against any registry.
• Reputation sources: the active blacklist hit should be re-checked after any remediation or operator response.

Summary Verdict

The site carries an elevated risk posture. Its technical hygiene is reasonable: encryption is valid, no overtly malicious page behaviour was observed, and its history is continuous. However, a confirmed external blacklist hit and brand-lookalike positioning outweigh these factors. Its legitimacy and operator are unverified, and it should be treated as unproven and potentially hazardous for anything beyond passive viewing.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and WAF. All four observed addresses are edge servers, and no origin address was observable. This is a mitigating factor only: it reflects ordinary commodity hosting, does not indicate a reputable operator, and prevents independent verification of the true host. The hosting platform's free subdomain model also lets content be changed or replaced quickly without any registration or vetting step.

Closing Assessment

The site should be limited to passive, read-only viewing at most. No login, credential entry, wallet connection or payment should be attempted unless the brand owner independently confirms the page as official and the blacklist status is cleared.