Is Pages a scam? TrustSniffer's high-risk assessment of echomirror.pages.dev: 5/100

Security Alert

Fortinet, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This site is a subdomain on a free, shared static-hosting platform, with a name suggesting a "mirror" or "echo" service. Its purpose and business model cannot be determined from what was captured. An automated visit reached only a security interstitial titled as a suspected-phishing warning, not the site's own homepage or product content. The site presents no observable commercial offering, and its apparent function is unknown.

Scam/Impersonation Risk

Contradictory signals are present and substantial. Several independent security engines currently flag the domain as malicious, and a further engine marks it suspicious. Those detections include two major, well-regarded security vendors. Reputation sources taken together confirm a blacklist listing, and archive records also carry a known-phishing marker for the domain. This is the decisive factor. No conflicting legal identities and no brand impersonation were observed. That is because no legal or about pages could be captured, not because the site was cleared. The captured response was an HTTP 403 interstitial titled as a suspected-phishing warning. Behavioral testing was less alarming in some respects and unfavorable in others. Three test runs completed normally, with no wallet-connection prompts, clipboard manipulation, hidden forms, external password forms or fingerprinting. The pages did issue an unusually heavy volume of third-party requests, and nearly all requests in the heaviest runs went to external hosts. The page structure also shifted sharply after interaction and produced repeated console errors. This pattern is consistent with content that is assembled or swapped dynamically. It is also consistent with a heavily scripted front end, so on its own it is not proof of malicious intent. The site's apparent age compounds the concern, since a short history sits alongside a serious reputation problem. The content was never captured, so no specific products, yield claims or contact artifacts can be assessed. Evidence:

• Homepage capture: returned an HTTP 403 security interstitial titled as a suspected-phishing warning, with only a short block of text and no site content.
• Threat intelligence: 9 engines flag the domain as malicious and 1 as suspicious; two tier-one vendors are among them, and a blacklist listing is confirmed.
• Domain provenance: domain age ~1.9 years; 13 archive snapshots spanning 2024–2026 (3 years tracked), first captured in December 2024. The archive also carries a known-phishing marker.
• Behavioral sandbox (homepage): 119 external XHR/fetch calls, 4 external POSTs, 11 console errors, and a DOM change of 1,508 mutations after interaction.

Regulatory Verification Notes

No legal, terms, privacy or about pages could be captured, so no operating entity, licence, registration number or regulator is attributable to the site. The real-world operator is not independently identified. The domain sits under a shared hosting platform's namespace, so its registration identity says nothing about who actually runs the site. Ownership and governance are opaque, and the site gives no on-page basis for connecting it to a named company or any financial-services registration. Third-party broker-reputation datasets hold no matching record. That is neutral and does not vouch for the site. On the technical side, the site uses a valid, properly issued TLS certificate, which is standard hygiene and does not offset the reputation findings. Nothing here suggests regulated status. Evidence:

• Legal and identity pages: none captured; the only content observed was the security interstitial, so no entity name, licence or registry reference exists to check.
• Broker-reputation lookup: no match found; this is not a licensing or regulatory verdict.
• Transport security: TLS certificate issued by WE1 (DV, domain-validated only), valid to 2026-12-18, so it confirms control of the domain and nothing about the operator.
• Hosting: served from AS13335 (Cloudflare, Inc., US).

What to Verify Next

Treat the site as a threat until the malicious-detection listings are independently reviewed and cleared. Check the domain's current status directly with the major reputation services and browser safe-browsing warnings before any visit. Establish who actually operates the site by tracing how the link reached you, such as an email, message or advertisement, and confirm the sender through an independent, offline channel. If the site claims affiliation with a known brand or service, locate that organisation's official website through a trusted search or its published materials and compare. Do not rely on any link or contact detail supplied by the site. If the link arrived unsolicited, report it to the hosting platform's abuse channel and to your security team. Any financial or licensing claim should be confirmed with the relevant regulator's public register, since none is evidenced here. Evidence:

• Reputation services: current malicious detections and the confirmed blacklist listing are the first items to re-check.
• Homepage: the suspected-phishing interstitial indicates the platform itself has raised concern about this address.
• Legal pages: absence of any identifiable entity means that any licence claim needs registry confirmation.

Summary Verdict

The overall posture is high risk. The convergence of confirmed blacklist listings, multiple malicious engine detections and a phishing warning on the only captured page is decisive. The domain's short history and an unidentified operator add to that picture. The valid certificate, clean wallet and clipboard behavior, and a continuous archive record are real but modest mitigants. They do not outweigh the external threat findings.

Infrastructure Integrity

The site is served entirely through Cloudflare's CDN and WAF, and all four observed IP addresses are Cloudflare edge servers across IPv4 and IPv6. The origin server is not visible. That limits independent verification of the actual hosting and means content could be changed without any visible infrastructure change. The CDN's presence is a mitigating factor only, since it is a shared, widely trusted platform used by legitimate and abusive sites alike. It cannot offset the reputation findings. Bot-protection challenges are active, which fits the 403 interstitial seen during capture.

Closing Assessment

Do not log in, enter credentials, connect a wallet, download files or make any payment on this site. Any visit should be limited to isolated, read-only inspection by a security team. Anyone who has already interacted with it should change affected passwords and review account activity.