Is dashboards-usepaid.xyz a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a single-page "Pre-Trial Claims Portal" that presents itself as an official New York legal notice delivery service acting on behalf of Sony Music Entertainment. It tells visitors that a claim notice is issued to a named respondent, that a private link in a notification message opens the full notice, and that a response must be recorded within a fixed window before the matter is "referred for court processing." No fee is stated and the economic purpose is unclear. The page's main function appears to be pressing recipients to act on an unverifiable legal threat.

Scam/Impersonation Risk

No formal contradictions were observed. There are no confirmed phishing findings, no conflicting legal identities, and no detected brand-impersonation match. One major security vendor does currently flag the domain, which is a soft reputational signal and not a confirmed listing. The page content is nonetheless a recognised deceptive pattern. The homepage invokes a named major rights holder, the State of New York and a court process, and it sets a response deadline. It supplies no case lookup, no legal entity, no court or docket reference and no usable correspondence address, and the address field is garbled. The page says notices are "not listed, indexed or searchable" and can be reached only through a link in a message. That design means a claim cannot be checked on the site, and it fits phishing or extortion-style lures sent to unsuspecting recipients. The appeal instructions are cut off mid-sentence and direct the respondent to "the account," with no login context. This could funnel recipients into a credential or payment step later in the process. The page's statement that it never asks for passwords, codes or payment cannot be tested, and a self-declared reassurance does not offset the missing proof. The domain name suggests a payments or dashboard service and has no evident connection to a legal-notice function or to the named rights holder. It sits on a low-cost, uncommon top-level domain and was registered only weeks ago. Page behaviour was otherwise unremarkable: there were no forms, login prompts, external network calls or wallet interactions during testing. Evidence:

• Homepage: states it delivers pre-trial notices for a named music rights holder under "United States of America — State of New York," but gives no case lookup, claimant representative or court reference.
• Homepage: the correspondence address field is garbled, and the appeal instructions are truncated and refer to an unexplained "account."
• Domain registration: registered 2026-09-18 (~31 days old) through NICENIC INTERNATIONAL GROUP CO., LIMITED, which makes it a very new domain. The domain name has no apparent link to legal services or to the named rights holder.
• Browser testing: three successful runs, with no forms, hidden forms, external posts or cloaking, so the risk lies in the content and not in active malicious behaviour.

Regulatory Verification Notes

The site claims judicial or quasi-judicial authority but provides no verifiable basis for it. It names no operating legal entity, no authorised representative, no court or docket identifiers and no regulator. It claims no licence and no registration, so the issue is unsupported legal-process claims and not a licensing gap. The site also has no privacy policy, terms page or about page. Third-party broker reputation data returned no match, so there is no external regulatory context for the site. Any association with the named rights holder remains unconfirmed. The site's identity as a real-world operator is unverified, and nothing on the page substantiates it. Evidence:

• Homepage: no legal entity, claimant name, representative or court identifier is published for a page that makes legal-deadline claims.
• Site structure: no linked legal, terms, privacy or about pages were observed, and the page has no internal or external links.
• Hosting: served from AS13335 (Cloudflare, Inc., US).
• Transport encryption: TLS certificate issued by YE1 (DV, domain-validated only), valid to 2026-12-17. This confirms encryption and does not confirm who operates the site.

What to Verify Next

Anyone who received a message pointing to this portal should not use its link or its appeal process. The claim should first be checked through channels found independently, not through anything the message or page supplies. The rights holder named on the page can be asked, through its publicly listed legal or enforcement contacts, whether it issued any notice through this service. The relevant New York court clerk can be asked, using independently sourced contact details, whether the referenced matter exists. The official support and contact channels of any party involved should also be confirmed offline. The message that carried the link deserves scrutiny of its sender, headers and timing, and a report to the rights holder or the recipient's security team may be appropriate. Evidence:

• Homepage: the delivery process depends on a private link in a notification message, so the message's origin is the first thing to examine.
• Homepage: the response deadline and the "referral for court processing" language are the pressure points to test against official court records.
• Homepage: the appeal step refers to an unexplained "account," which is a further reason to avoid acting on the page's instructions before the claim is verified.

Summary Verdict

The available evidence points to an elevated-risk site. Unverifiable legal-authority claims, urgency framing, a very recently created domain and an external security-vendor flag converge on a pattern consistent with phishing or extortion-style notices. The site's real-world operator and its connection to the named rights holder are unverified, and its content is not credible as a genuine legal service.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and WAF, and all observed addresses are edge servers, so the origin server cannot be seen. This is a mitigating factor only. It shows that the site uses mainstream protective infrastructure, which says nothing about the operator's legitimacy. It also prevents independent hosting verification and can mask rapid content changes. The domain's DNS footprint is young and sparse, which is consistent with a recently created site.

Closing Assessment

Treat the portal as unverified and untrustworthy until the claim is confirmed through an independent, offline route. Do not follow its private link or appeal instructions, and enter no credentials or payment details. Forward the original message to the relevant security team or to the named rights holder for review.