Verdict
This assessment found strong scam indicators. Do not pay, sign in, or share personal details with this site.
etfswappresales.pages.dev shows high-risk / scam indicators.
Evidence status and limitations
Evidence completeness: Not recorded
- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.
At a glance
The checks that decide most of this verdict.
| Malware engines | 5 flagged itVirusTotal | Risk |
|---|---|---|
| Google Safe Browsing | Not listedGoogle | Clear |
| Abuse reports on the host | 0% confidenceAbuseIPDB, 0 reports; shared hosting inflates reports | Clear |
| Domain age | 1.6 years oldRegistered history | Clear |
| Web archive | Archived since 20254 snapshots | Clear |
| Certificate | Encrypted connectionIssued by WE1 | Noted |
The page as captured
Key findings
- Automated classification: Sensitive Interaction Risk.
- Domain age: 1 to 3 years (registration continuity).
- Public web-archive history exists since 2025.
- At least one reputation service TrustSniffer consulted had flagged this domain at assessment time.
Full analysis
Security Alert
Fortinet flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.
This website is a single-page presence on a free, shared hosting subdomain that presents itself as an "ETFSwap" tokenization platform for tokenized exchange-traded funds in crypto. Its address frames it as a presale, so its apparent purpose is to attract visitors toward a token or tokenized-asset offering. The page carries a large volume of text, but it does not tie the offering to any independently verifiable operator.
Scam/Impersonation Risk
Contradictory signals are present, and they drive the cautionary posture of this report. Several independent security engines currently flag the site as malicious, and one of them is a top-tier security vendor. The overall external reputation picture amounts to a confirmed blacklist hit. The site presents itself as a tokenized-ETF platform, which is a trust-borrowing theme that fraud operations commonly use for presale and token-investment lures. Nothing independent connects the page to any established issuer or brand carrying a similar name, and the operator's real-world identity remains unestablished. Two further findings sit outside the reputation hit. No conflicting legal entities were found. In behavioral testing, the page showed no wallet-drainer routines, clipboard tampering, hidden forms, credential posts to outside parties or cloaking. Its outbound traffic went only to recognized destinations. The page also generated a high volume of script errors and very heavy structural rewriting after interaction, which is consistent with a dynamically assembled front end. These behavioral points do not offset the active threat detections.
- Homepage: security engines currently classify the site as malicious, with one top-tier vendor among them, and the reputation checks produced a confirmed blacklist hit.
- Homepage: the domain was registered about 1.65 years ago (~602 days), which is young for a platform claiming to handle tokenized securities.
- Web archive: 4 snapshots from January to March 2025 (about 1 year tracked), with no content repurposing detected.
- Homepage behavior: 105 external background requests and 12 external form posts, all to recognized destinations. 60 console errors and 7,301 page mutations after interaction. No wallet-connect, drainer or clipboard-hijack activity.
Regulatory Verification Notes
The assessment found no licensing, registration or regulatory authorization for any securities, ETF-tokenization or investment-service activity. The site's real-world operator cannot be independently connected to the page, and both ownership and governance transparency are limited. A platform offering tokenized funds and presale participation would ordinarily be expected to disclose a legal entity, jurisdiction and supervisory status. In this case that absence stacks on top of the active threat detections and reinforces the high-risk reading. No third-party broker-reputation record matched this site, so that dataset adds nothing in either direction. Valid transport encryption confirms only that the connection is encrypted. It says nothing about who runs the site or whether it is legitimate.
- Homepage and legal content: no named operating entity, licence or registration reference was identified.
- Hosting: served from AS13335 (Cloudflare, Inc., US), on a shared-platform subdomain rather than an independently registered brand domain.
- Transport encryption: TLS certificate issued by WE1 (DV, domain-validated only), valid to 2027-01-12 (78 days remaining at assessment).
What to Verify Next
No sensitive interaction should proceed until the site's claims are independently confirmed. The ETFSwap name should be checked against the official channels of any established project or issuer using that name, reached through an independently sourced route rather than any link on this page. Any claim of regulated tokenized-fund or presale activity should be checked against the relevant securities or financial-services registry in the jurisdiction the operator names. If the site names none, that gap itself should be treated as a stop signal. The official support and contact channels should also be confirmed offline. Any token contract or presale address the page promotes should be checked against a public blockchain explorer and an independent project listing before any funds move.
- Homepage: promotes tokenized ETFs and a presale-style offering without a verifiable issuer.
- DeFi directories: the site is not recognized in the DeFiLlama protocol directory, so no independent record of a live protocol or its value locked exists.
- Homepage: no named regulator, registry number or audit report was found to cross-check.
Summary Verdict
The overall posture is high risk. Active threat detections combine with an unverified operator and a young domain to produce an elevated-risk classification. The behavioral evidence shows no overtly malicious on-page mechanics, but that evidence cannot offset the reputational findings.
Infrastructure Integrity
The site is delivered through Cloudflare's CDN and WAF, and all four observed addresses are edge servers in the Cloudflare network (AS13335, registered with ARIN, US). The origin server was not visible, which limits independent verification of where the content is actually hosted. The protective infrastructure and valid certificate are mitigating factors only. They do not offset the external threat detections, and they do not establish legitimacy.
Closing Assessment
The site should not be used for login, credential entry, wallet connection, deposits or any other financial interaction. At most, it should be viewed read-only from an isolated environment. Anyone who has already interacted with it should treat any credentials or approvals they provided as exposed. They should rotate those credentials and revoke any token permissions.
Written analysis generated 2026-10-26 by the TrustSniffer Analysis Engine from the evidence in this report.
What the analysis found
3 findings contributed to this verdict, raised by external reputation, behaviour in a sandbox, registration and ownership.
01 External reputation
- An external threat feed lists this domain: either Google Safe Browsing marked it malicious, or a significant number of malware engines flagged it.External reputation
rule:EXT_BLACKLIST_CRITICAL
02 Behaviour in a sandbox
- The page replaced a large part of its own content after loading.Behaviour in a sandbox
rule:BEHAV_DOM_CHANGE_HIGH - A large share of what the page loaded came from other domains.Behaviour in a sandbox
rule:BEHAV_EXTERNAL_RATIO_MODERATE - The page rewrote itself after it was interacted with, so what a visitor first sees is not what they end up on.Behaviour in a sandbox
rule:BEHAV_DOM_DIFF_AFTER_INTERACTION - The structure of the page changed sharply while it was loading.Behaviour in a sandbox
rule:BEHAV_DOM_DENSITY_SPIKE
03 Registration and ownership
- The public registration record for this domain is incomplete.Registration and ownership
rule:KF_WHOIS_INCOMPLETE
Identity verification
| Status | UNKNOWN |
|---|---|
| Identity score | 50/100 |
| Identity verification confidence | 30% |
- AI page analysis unavailable (page captured; identity not AI-verified)
Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence.
What TrustSniffer observed
First-party facts recorded during the assessment of etfswappresales.pages.dev.
- The request stayed on etfswappresales.pages.dev. It was not redirected to another domain. Clear
- The earliest public archive of this site is from 2025-01-04. Clear
- It is hosted on CLOUDFLARENET, from a server in US. Noted
Domain intelligence
| Registrar | Not available |
|---|---|
| Hosting | CLOUDFLARENET - Cloudflare, Inc., US |
| Country | US |
| Server IP | 2606:4700:310c::ac42:2ef7 |
| Name servers | Not available |
| CDN / edge network | Detected (cloudflare) |
| Resolved IP addresses | 4 |
| Edge IP addresses | 4 |
| Likely origin IP addresses | 0 |
| SSL issuer | WE1 |
| SSL expiry | 2027-01-12 |
| Domain age | 1.65 years (continuous registration) |
| Domain expiry | Not available |
| Archive first seen | 2025-01-04 |
| Archive snapshots | 4 |
| Reputation | VirusTotal: 5 flagged | AbuseIPDB: 0% confidence, 0 reports | Google Safe Browsing: 0 matches |
About this assessment
A trust score summarises the evidence TrustSniffer could collect about etfswappresales.pages.dev at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.
TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.