Is eligibility-peaqnetwork.pages.dev safe? TrustSniffer's low-trust assessment: 40/100

Security Alert

Fortinet flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

The site is a free-tier hosted web page on a shared Cloudflare Pages subdomain. Its hostname pairs the word "eligibility" with "peaq network", so it presents itself as an eligibility-check or claim-style page connected to a blockchain project. When fetched, the page returned a platform interstitial titled as a suspected-phishing warning instead of ordinary site content. Its apparent purpose is to funnel visitors into an eligibility or onboarding flow, and the operator behind that flow is not identified.

Scam/Impersonation Risk

Confirmed contradictory signals are present, and the overall posture is clearly cautionary. A major security vendor classifies the site as a threat, and further scanning engines independently rate it malicious or suspicious. These detections amount to a confirmed blacklist-level reputation problem. The page that loaded for the automated visit was a platform-issued suspected-phishing warning with a blocked response, so the platform's own protection layer has already reacted to this address. The hostname follows a naming pattern commonly used for token-claim and eligibility lures that borrow a known project's name. No on-page content could be analysed, so impersonation of the named project is not confirmed. No conflicting legal identities were found, and no phishing form, hidden form, wallet-connection prompt or clipboard manipulation was observed in sandbox runs. These absences do not offset the external detections, because the sandbox never reached usable page content. The sandbox did record heavy cross-origin traffic. Nearly all dynamic requests went to external origins, with a large number of background fetches and several outbound POST submissions, all to destinations on the known-service list. The page also showed a sharp burst of DOM mutation after interaction and a high rate of console errors. Taken together, that is the behaviour of an assembled, script-driven front end that loads most of its logic from third parties. Evidence:

• Hostname: the homepage sits on a shared hosting subdomain whose name combines "eligibility" with the name of an established blockchain project.
• Homepage capture: the response was a blocked bot-challenge page titled as a suspected-phishing warning.
• Threat intelligence: 2 engines rate the domain malicious and 2 suspicious, including one major security vendor, and the domain is on an external blacklist.
• Provenance: observed for about 1.96 years, with 11 archive snapshots spanning 2024–2026 (3 years tracked).

Regulatory Verification Notes

No licensing, registration or legal-entity information could be read from the site, and no third-party broker or regulatory record matches it. Because the hostname is a shared-platform subdomain, there is no dedicated registrant whose identity could anchor the site to a real organisation. Operator identity is therefore unverified, and ownership is opaque. This is an identity-verification gap, not a contradiction in itself, but it removes the usual means of attributing responsibility if funds or credentials are lost. The technical hygiene observed (valid transport encryption and an identifiable network provider) is routine for any site on this platform, so it carries no weight as evidence of legitimacy. Evidence:

• Transport encryption: TLS certificate issued by WE1 (domain-validated only), valid to 2027-01-19, so it confirms an encrypted connection but nothing about who runs the site.
• Hosting: served from AS13335 (Cloudflare, Inc., US).
• Legal and identity pages: none were retrievable, and no regulator or broker-database match exists for the site.

What to Verify Next

Any claim of eligibility, allocation or reward should be checked only through the named project's officially announced channels, reached by an address obtained independently of this site, not through any link, message or social post that led here. The referrer that delivered the visitor should be treated as suspect and, if it was a message or advertisement, reported. An abuse report to the hosting platform can establish whether the deployment has been actioned or removed. If any wallet connection, signature or credential entry has already occurred, the affected wallet approvals should be reviewed and revoked, and passwords changed. Transfers to a fresh wallet should be considered if any exposure is suspected. Evidence:

• Hosting: the site is a shared-platform deployment, so the platform's abuse process is the available enforcement route.
• Sandbox behaviour: outbound POST submissions occurred in the sandbox, so entered data could be transmitted to third parties.
• Homepage: the platform's warning page indicates the deployment has already been flagged.

Summary Verdict

The assessment is low trust with a high-severity risk posture. Active threat-intelligence detections drive this conclusion, and nothing observed offsets them. The unidentified operator and the unverifiable page content leave no basis for treating the site as legitimate, so its association with the named project must be treated as unproven and potentially deceptive.

Infrastructure Integrity

The site is served entirely through Cloudflare's CDN and web application firewall, and every observed address is an edge server. The origin host is not observable, which prevents independent hosting verification and makes rapid content changes easy to conceal. The provider's bot protection and the valid certificate are mitigating factors only, and they cannot offset the reputational detections above.

Closing Assessment

The site should be treated as unsafe for any interaction beyond passive viewing. No wallet connection, signature request, credential entry, claim submission or payment should be made. Anyone who arrived through a message or advertisement should discard it and use only independently confirmed official channels.