Is eeeer2322.pages.dev a scam? TrustSniffer's high-risk assessment: 5/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

The website is a subdomain on a public static-site hosting platform (a randomly named Cloudflare Pages address) and not a branded standalone domain. When the analysis captured its homepage, the visitor-facing result was a short security interstitial titled as a suspected-phishing warning, with only a small amount of text and no recognizable product, brand, or service content. The site's apparent purpose and business model therefore cannot be established from its own content, and it presents no verifiable commercial identity.

Scam/Impersonation Risk

Contradictory signals are present and material. A substantial group of independent security engines currently classes the site as malicious, with a few more rating it suspicious. These include several widely used enterprise-grade vendors. This is a confirmed blacklist-level detection, and it is the decisive factor in the assessment. The homepage was also withheld behind a protective challenge that identified the address as suspected phishing, and the site's archive history carries a prior phishing association. These independent indicators converge on the same conclusion. No conflicting legal identities and no explicit brand impersonation were identified, because there is no identity content to compare. However, the address closely resembles its parent hosting platform's domain. That is the kind of lookalike naming pattern commonly used to borrow credibility from a trusted service. Runtime behaviour adds supporting context. Nearly all network activity during interaction went to third-party destinations, and the page produced repeated script errors and a very large burst of page changes after interaction. No wallet-drainer behaviour, clipboard tampering, hidden forms, or external password forms were detected in the sandbox. The risk therefore rests on the reputation findings, not on an observed credential-theft mechanic. Evidence:

• Homepage: 14 security engines flagged the domain as malicious and 2 as suspicious, including three tier-one vendors; the external blacklist check also returned a positive hit.
• Homepage capture: the request returned HTTP 403 with a bot-challenge page titled "Suspected Phishing", and only 381 characters of text were recovered.
• Domain registration dates from about 2.04 years ago, with 14 archive snapshots spanning 2024–2025 (2 years tracked, first seen 2024-10-05, last seen 2025-04-01) and a phishing flag in the archive record.
• Behavioural sandbox: 46 external XHR/fetch requests and 5 external POSTs in 3 runs, with 10 console errors and 1,508 DOM mutations after interaction.

Regulatory Verification Notes

The captured content contained no legal, terms, privacy, or about material. No company name, licence, or registration number could be assessed, so the disclosure position is unclear. No independent regulatory registration was found for the site, and no broker-reputation dataset matched it. Real-world operator identity is not verified, and nothing on the site supports a claim of regulated status. Registration details for the domain are incomplete, which is consistent with operator opacity. That opacity is administrative and is not an identity contradiction. The transport-encryption certificate is valid and issued by a recognised authority, but it is domain-validated only. It proves control of the hostname and says nothing about who operates the site or whether it is lawful, so it does not offset the reputation findings. Evidence:

• Homepage: no company name, licence, or registration number was recoverable from the captured content.
• Hosting: served from AS13335 (Cloudflare, Inc., US).
• Transport encryption: TLS certificate issued by WE1 (DV), valid to 2026-12-14, with the hostname covered by subject alternative names.
• No third-party broker or regulator listing matched this site.

What to Verify Next

The first step is to confirm, through an independent route, whether the organisation said to be behind this address exists and whether it actually uses this hosting address. The relevant company registry or financial regulator should be searched directly, using details obtained outside this site. Any link that led here (an advert, message, or referral) should be traced back to its sender and treated as unconfirmed until that sender is authenticated. The official support and contact channels of the claimed organisation should be confirmed through its established primary domain or another offline route. The domain should also be re-checked against threat-intelligence listings after the owner has had time to respond. A clean result would show only that the listing has been removed. It would not establish who runs the site. Evidence:

• Homepage: no identifiable organisation, product, or service is presented, so there is nothing on the site itself to verify against a registry.
• The security challenge issued at the homepage means the actual content that visitors are shown remains unconfirmed.
• Archive record: only a short two-year history exists, so there is no long-standing track record to corroborate the site.

Summary Verdict

The site carries an elevated, clearly adverse risk posture. Multiple independent reputation sources and a protective phishing challenge point the same way, and no content or identity evidence exists to counterbalance them. Mitigating technical hygiene, such as a valid certificate, does not change this conclusion. Available evidence indicates the address should be treated as hostile until it is cleared by the listing sources.

Infrastructure Integrity

The site is delivered through Cloudflare's CDN and WAF, and all observed addresses are edge servers within the same network. The origin server was not observable, which prevents independent verification of where the content is actually hosted. The edge provider's own bot-protection layer is the source of the phishing-warning interstitial. This is a mitigating factor only. The shared-platform hosting is common to legitimate and abusive sites alike, so it is not evidence of legitimacy. It cannot offset the external threat detections.

Closing Assessment

The address should not be used for login, credential entry, wallet connection, or any payment or financial interaction. Nothing should be downloaded from it. Any link or message that directed a user here should be reported and disregarded. Accidental visits should be limited to closing the page. Anyone who has already entered credentials or payment details should change those credentials and notify the relevant provider.