Is everrevoke.pages.dev a scam? TrustSniffer's high-risk assessment: 5/100

Security Alert

Fortinet, Google, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This is a subdomain site on a shared static-hosting platform, and the page served to a visitor is not ordinary site content. The capture returned an automated security interstitial titled as a suspected-phishing warning. That page carries little readable material, so the site's own purpose, products and business model cannot be established from what it presents. The evidence points to a throwaway-style deployment on a free hosting namespace rather than an established branded service.

Scam/Impersonation Risk

This site carries confirmed contradictory signals and warrants a clearly cautionary stance. A major browser-safety service currently flags it for social engineering, and a substantial group of independent security engines, including several top-tier vendors, classify it as malicious. Together these amount to a confirmed blacklist condition. This is the decisive finding and outweighs every neutral or favourable technical attribute. No conflicting legal identities were observed, and no brand impersonation was established from page content, because no readable brand content was captured. The danger therefore rests on the threat-intelligence listings rather than on any visible storefront or product claim. Behavioural testing adds context but is not itself incriminating. The page triggered a large volume of third-party requests, including several outbound POST submissions, and generated repeated console errors. It also showed heavy DOM churn after interaction. All outbound destinations were on recognised, whitelisted services. No wallet-connection prompts, wallet-drainer behaviour, clipboard hijacking, hidden forms or external password forms were detected. Those clean behavioural results do not offset the independent malicious listings. Phishing pages commonly sit behind interstitials and challenge layers that hide their payload from scanners. Evidence:

• Homepage: the page served was a phishing-warning interstitial returning an access-denied response behind a bot challenge, with only a short body of text.
• Reputation: the browser-safety service flags the site under the social-engineering category, and 15 security engines mark it malicious with one more suspicious.
• Sandbox behaviour: 83 external XHR calls and 5 external POSTs, all to whitelisted destinations, with 16 console errors and no wallet, clipboard or hidden-form activity.
• Domain provenance: registered about 2.1 years ago, with 8 archive snapshots spanning 2024–2025 (2 years tracked), which shows continuity but no established history.

Regulatory Verification Notes

No licence, registration number or legal-entity disclosure could be assessed, because no legal, terms or about page content was captured. No financial-services or regulated-entity claim was observed, and no third-party broker-reputation match exists for this name. Operator identity is not independently verified, and ownership opacity applies. That is an administrative limitation and is not the basis of the elevated assessment. Registration through a free shared-hosting namespace gives no standalone corporate identity to validate. The transport layer is technically sound, but a domain-validated certificate only confirms control of the hostname. It says nothing about the operator's legitimacy. Evidence:

• Technical telemetry: served from AS13335 (Cloudflare, Inc., US).
• Transport encryption: TLS certificate issued by WE1 (DV), valid to 2027-01-09.
• Brokerage and regulatory data: no regulator match and no third-party broker-reputation entry for this site.

What to Verify Next

Anyone who reaches this site through a message, advertisement or search result should confirm independently where the link came from. If it purports to represent a known brand or service, they should locate that brand's official site through a typed address or an offline source and compare it with this one. They should not follow links from the originating message. Any account, payment or document request linked to this address should be treated as unverified until the sender confirms it through a separate channel. The site owner should confirm whether the project is under their control, and should contact the hosting platform and the listing authorities to request a review if it is. Evidence:

• Hosting namespace: the site sits on a shared platform subdomain, so the address alone does not identify a legal operator.
• Current listings: the safe-browsing flag and the multi-engine detections are active now and have not been cleared.
• Page content: the visible text is a platform warning, not operator-authored material, so no official contact channel was captured.

Summary Verdict

The overall posture is high risk. Active, convergent threat-intelligence listings are decisive, and the site's technical hygiene and the limited continuity in its archive history cannot offset them. Operator identity is unverified, so no claim of legitimacy can be supported.

Infrastructure Integrity

The site is served entirely from a major CDN and WAF with bot-challenge protection active, and every observed address is an edge node. The origin server was not observable, so independent hosting verification is not possible. Protective infrastructure is a mitigating factor only. It does not reduce the reputational risk, and the same edge layer can mask rapid content changes behind a stable address.

Closing Assessment

Treat the site as unsafe for sign-in, credential entry, payments and file downloads, and do not interact with it beyond passive viewing, if at all. Any link that leads here should be reported to the person or platform that sent it.