Is dfhdfhdfhdh.pages.dev a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Google, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This is an anonymous, randomly named subdomain on a shared free-hosting platform. It has no recognizable brand and no descriptive content. The only material captured from the homepage was a short hosting-provider interstitial titled as a suspected-phishing warning, so no products, services or commercial purpose could be observed. The site's apparent purpose is unclear, and its reputation record points to a malicious or social-engineering function.

Scam/Impersonation Risk

Contradictory signals are present and severe. The site is blacklisted: a major browser-protection service currently classifies it under its social-engineering category. A substantial cluster of independent security engines also rates it malicious, including several top-tier vendors. These findings converge, and the reputation record is decisive. No brand impersonation or conflicting legal identities were established, because the captured content was only the hosting interstitial. The risk therefore rests on the reputation evidence, not on page-level deception. Sandbox behavior showed no wallet-connection prompts, clipboard manipulation or hidden credential forms. The browsing session did show a very high share of third-party requests and a large number of client-side script errors. Those behaviors do not offset the listing. The random, non-descriptive hostname on a free subdomain service, together with a very young registration, fits the profile of disposable infrastructure. Evidence:

• Homepage: the page served to the analysis browser was a hosting-provider interstitial titled "Suspected Phishing", returned with an access-denied status.
• Reputation sources: 10 engines flagged the site malicious and 2 suspicious, and the browser-protection listing carries a social-engineering threat type.
• Domain provenance: registration continuity of about 0.24 years (~88 days), with 1 archive snapshot (first and last seen 2026-08-02, 1 year tracked).
• Sandbox behavior: 3 of 3 runs completed, 18 console errors, 24 external XHR/fetch calls and 4 external POSTs, all to whitelisted destinations. No wallet-drainer, clipboard or hidden-form activity was detected.

Regulatory Verification Notes

No licensing, registration or legal-entity information could be assessed. The only content served was the interstitial, so no terms, privacy or about page was observed. The operator is behind ownership opacity, and no real-world identity could be linked to the site. This is an administrative limitation, and it matters here only because it comes with an adverse reputation record. No broker-reputation entry matched the site, so no third-party broker signal applies. A regulated financial or commercial claim cannot be credited to this property. Evidence:

• Homepage: no company name, license number or regulator reference was visible, because only the interstitial was returned.
• Hosting: served from AS13335 (Cloudflare, Inc., US, ARIN registry).
• Transport security: TLS certificate issued by WE1 (DV, domain-validated only), valid to 2027-01-12. DV validation confirms control of the hostname and says nothing about who operates the site.
• Domain: a subdomain of a shared hosting platform, so no independent registration record identifies an operator.

What to Verify Next

Anyone who received this address should first establish how it reached them, such as an unsolicited message, advertisement or redirect. If it claimed to represent a bank, exchange or other brand, the link should be set aside and the brand contacted through an independently known channel. Any claimed license should be checked in the regulator's own public registry using the entity name, not details taken from this site. The listing status should be rechecked later, since a compromised or newly flagged site can be cleaned and delisted. The hosting platform's abuse process is the appropriate route for reporting. Official support and contact channels should be confirmed through an offline or independently sourced route. Evidence:

• Homepage: the interstitial was served instead of site content, so no claimed identity or license could be tested.
• Reputation: both the browser-protection listing and the multi-engine detections were active at the time of analysis.
• Registration: the very recent domain registration means no long operating history can be relied on to vouch for the operator.

Summary Verdict

The site carries an elevated, high-risk posture. Active blacklisting and broad malicious classification by independent security sources are decisive, and no legitimacy evidence offsets them. An unidentified operator and a very short history add to that posture without changing it. The site should be treated as hostile until its reputation record is cleared.

Infrastructure Integrity

The site sits behind a major CDN and WAF, and its only observed addresses are edge nodes of that provider. The origin server was not observable, so independent verification of the underlying host is not possible. The TLS certificate is valid and from a recognized issuer, with ample validity remaining. Bot-protection challenges also gated the page capture. These are mitigating hygiene factors only. They are commodity protections available to any tenant, and they cannot offset a reputation record this adverse.

Closing Assessment

Account login, credential entry, payment and any other financial interaction should be avoided entirely. Nothing should be downloaded from the site. If the address must be inspected, it should be done only in an isolated environment, without interaction. If the site belongs to the user, it should be treated as potentially compromised and cleaned before a delisting review is requested.