Verdict
Several risk patterns were present. Do not send money or personal details until you have verified this business another way.
en-flareportal.pages.dev is low-trust and potentially risky.
| What this site appears to be | The page is a Cloudflare interstitial stating that the requested website has been reported for potential phishing, with a Ray ID and IP shown and a 'Learn More' link. It contains no forms, login fields, product content, or verifiable business or legal details for the underlying site. |
|---|
Evidence status and limitations
Evidence completeness: Not recorded
- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.
At a glance
The checks that decide most of this verdict.
| Malware engines | 6 flagged itVirusTotal | Risk |
|---|---|---|
| Google Safe Browsing | Not listedGoogle | Clear |
| Abuse reports on the host | 0% confidenceAbuseIPDB, 0 reports; shared hosting inflates reports | Clear |
| Domain age | Not availableNo registration record was returned | Noted |
| Certificate | Encrypted connectionIssued by YE1 | Noted |
| Hosted by | CLOUDFLARENETServer in US | Noted |
The page as captured
Key findings
- Automated classification: Sensitive Interaction Risk.
- At least one reputation service TrustSniffer consulted had flagged this domain at assessment time.
- The operator behind the site could not be independently connected to a real-world brand or person.
Full analysis
Security Alert
Fortinet flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.
The website is a subdomain on a shared developer-hosting platform. When visited, it shows only a Cloudflare "Suspected Phishing" interstitial stating that the destination has been reported for potential phishing. The captured page has no products, pricing, login or payment flows, or legal and contact details. Its purpose and business model therefore cannot be determined, and the only content a visitor sees is a third-party security warning.
Scam/Impersonation Risk
This assessment is clearly cautionary. Multiple independent external security detections flag the site as malicious, and a confirmed blacklist listing is present. That is a confirmed adverse reputation signal, not a heuristic. The platform-level warning that the site was reported for phishing is consistent with those detections. Together they make this the decisive factor in the assessment. The hostname is a user-created label on a shared hosting platform and offers no assurance about who operates the content. The page analysis also found a close lookalike relationship to the platform's own naming. It did not confirm brand impersonation or conflicting legal identities, so the risk rests on the blacklist and phishing-report signals. The captured page has no forms or credential fields, so the reputation signals cannot be tied to a specific harvesting mechanism from this capture. Because the warning page replaces the site's real content, the underlying pages could not be assessed directly. A site that carries these warnings and may serve different content to different visitors should not be treated as safe for sensitive interaction. Evidence:
- Homepage: the only content is a Cloudflare interstitial stating the website "has been reported for potential phishing", with a "Learn More" link and no business content.
- Reputation: 6 security engines returned a malicious verdict, including a Tier-1 vendor, and an external blacklist listing is confirmed.
- Homepage behavior: no forms, login fields or wallet-connection activity were observed. The page showed 12 console errors and heavy external request activity.
Regulatory Verification Notes
The captured page has no legal, terms, privacy, about or contact content. It names no operating company, registration number, license or regulator, and no third-party broker record matches the site. The absence of operator identity means no real-world entity can be connected to the site, so its identity remains unverified. No licensing claim was made, so none can be assessed. This is a verification gap and not, by itself, evidence of wrongdoing. The adverse reputation signals described above are what drive the risk classification. Ownership and governance transparency are limited in this assessment. Evidence:
- Homepage: no company name, license, registration number or regulator reference is presented.
- Hosting: served from AS13335 (Cloudflare, Inc., US).
- Transport encryption: the TLS certificate is a domain-validated (DV) certificate issued by YE1, valid to 2026-12-14. DV validates only domain control, not the operator's identity.
What to Verify Next
Confirm the origin of the link that led to this site, using an independent route such as the organisation's official channel. Do not rely on messages or ads that supplied the address. Review the details behind the platform's phishing warning, and check whether the hosting platform or the reporting party has recorded an outcome. If the operator claims any financial, trading or other regulated activity, validate the claimed license directly with the relevant regulator's own register. Any later re-assessment should wait until the interstitial is lifted and the real site content is visible. Evidence:
- Homepage: the warning page offers a "Learn More" route for details of the report, and no operator contact route is shown.
- Reputation: multiple independent security detections remain active and should be re-checked for removal before any change in posture.
Summary Verdict
The site carries an elevated, high-severity risk posture driven by confirmed external threat detections and a third-party phishing warning. These outweigh its technically valid encryption, and nothing observed offsets them. The operator's identity is unverified and the underlying content could not be reviewed. The evidence supports a clearly cautionary classification, not a neutral or provisional one.
Infrastructure Integrity
The site is delivered through Cloudflare's CDN and WAF. All four observed addresses are edge servers, and the origin could not be seen. That fits the platform's normal behavior, and the hosting provider is a mainstream, trusted one. The infrastructure shows no sign of abuse reports. It is a mitigating factor only and does not offset the external threat detections.
Closing Assessment
At most, the site should be treated as read-only, and a visit is best avoided altogether. No login, credentials, personal information, wallet connection or payment should be entered or made, and nothing should be downloaded. Anyone who received the address through an unsolicited message should report it to the sender's organisation.
Written analysis generated 2026-10-20 by the TrustSniffer Analysis Engine from the evidence in this report.
What the analysis found
3 findings contributed to this verdict, raised by external reputation, page content, registration and ownership.
01 External reputation
- An external threat feed lists this domain: either Google Safe Browsing marked it malicious, or a significant number of malware engines flagged it.External reputation
rule:EXT_BLACKLIST_CRITICAL
02 Page content
- The page shows few of the signs expected from a trustworthy operator.Page content
rule:PAGE_TRUST_QUALITY_LOW - The review of the page content rated it moderate risk.Page content
rule:PAGE_RISK_MED - The page appears to present itself as a known brand it is not verified to belong to.Page content
rule:PAGE_BRAND_SUSPECTED - The browser raised a warning while loading the page.Page content
rule:PAGE_BROWSER_FLAGS_SUSPICIOUS
03 Registration and ownership
- The public registration record for this domain is incomplete.Registration and ownership
rule:KF_WHOIS_INCOMPLETE
Identity verification
| Status | UNVERIFIED |
|---|---|
| Identity score | 30/100 |
| Identity verification confidence | 50% |
- No on-site identity signals detected
Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence.
What TrustSniffer observed
First-party facts recorded during the assessment of en-flareportal.pages.dev.
- The request stayed on en-flareportal.pages.dev. It was not redirected to another domain. Clear
- It is hosted on CLOUDFLARENET, from a server in US. Noted
Domain intelligence
| Registrar | Not available |
|---|---|
| Hosting | CLOUDFLARENET - Cloudflare, Inc., US |
| Country | US |
| Server IP | 2606:4700:310c::ac42:2fb0 |
| Name servers | Not available |
| CDN / edge network | Detected (cloudflare) |
| Resolved IP addresses | 4 |
| Edge IP addresses | 4 |
| Likely origin IP addresses | 0 |
| SSL issuer | YE1 |
| SSL expiry | 2026-12-14 |
| Domain age | Not available (no registration date was returned) |
| Domain expiry | Not available |
| Archive first seen | Not available |
| Archive snapshots | Not counted (archive lookup incomplete) |
| Reputation | VirusTotal: 6 flagged | AbuseIPDB: 0% confidence, 0 reports | Google Safe Browsing: 0 matches |
About this assessment
A trust score summarises the evidence TrustSniffer could collect about en-flareportal.pages.dev at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.
TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.