Is Pages a scam? TrustSniffer's high-risk assessment of fenoto.pages.dev: 0/100

Security Alert

Fortinet flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a project hosted on a free-tier static-hosting subdomain. When an automated visitor requested its homepage, it received a short interstitial page headed "suspected phishing", not any site content of its own. No products, services, branding or business model could be read from what was presented. Its apparent purpose is therefore unestablished, and it appears to be a recently created, low-footprint deployment of the kind commonly used for throwaway or abusive pages.

Scam/Impersonation Risk

Contradictory signals are present and weigh decisively against the site. The domain is blacklisted by external threat-intelligence sources. Several independent detection engines classify it as malicious, and one of them is a tier-one security vendor. The page served to the scanner was itself a phishing-warning interstitial, which is consistent with those detections. No conflicting legal identities and no specific brand impersonation were observed. The elevated risk comes from the threat listings, not from identity inconsistency. The behavioural sandbox found no wallet-connection prompts, clipboard manipulation, hidden forms or password forms posting to third parties, and every external destination contacted was on a known-good list. These clean results are not mitigating. Content can be swapped quickly on a site like this, and a short observation window cannot offset current blacklist hits. The page was also very heavy in external requests and in-page rewriting after interaction. That is unusual for a page that displays so little content. Evidence:

• Homepage: the page title and body presented a suspected-phishing warning, and the capture returned an access-denied status (403) behind a bot challenge.
• External reputation: 4 engines rated the domain malicious and 1 suspicious, including a tier-one vendor, and the domain also appears on an additional external blacklist.
• Provenance: the domain is about 88 days old (~0.24 years). The web archive holds 1 snapshot, first and last seen 2026-08-02, covering 1 year tracked.
• Homepage behaviour: 115 external XHR/fetch calls and 4 external POSTs were observed, with 96.7% of activity directed externally. There were 1,508 DOM mutations after interaction and 6 console errors.

Regulatory Verification Notes

No legal, licensing or corporate-registration information could be associated with this site. The only content presented was the warning interstitial, so no legal-entity name, terms page, privacy policy or regulator reference was available. Ownership and governance are opaque, and the real-world operator cannot be linked to any brand or person. This is a verification gap, not evidence of wrongdoing in itself. Here it sits alongside confirmed threat listings, so it cannot be treated as a neutral administrative omission. No third-party broker or regulator record matched this domain. The technical foundations are ordinary and do not establish legitimacy. The certificate is a domain-validated type, which proves control of the domain and says nothing about who operates it. Evidence:

• Homepage: no company name, licence number, jurisdiction or contact details were present in the captured content.
• Hosting: served from AS13335 (Cloudflare, Inc., US).
• Transport encryption: TLS certificate issued by YE1 (DV), valid to 2027-01-12.
• Third-party registries: no broker-reputation record was matched for this domain.

What to Verify Next

Any party that supplied this address (an email, message, advert or social post) should be asked to confirm it through an independent, previously trusted channel. The site should not be used as proof of its own legitimacy. An organisation that claims to operate it should be able to show the address on its official website or documented communications. Any claimed licence or registration should be checked directly in the relevant regulator's public register, using details obtained outside this site. The domain's reputation status should be re-checked after any stated clean-up, and an apparent warning page should not be bypassed to "see what is behind it". Evidence:

• Homepage: the only content presented was a phishing-warning interstitial, so no claim on the site could be tested.
• External reputation: the current detections remain active and have not been withdrawn.
• Provenance: a single archive capture gives no earlier history against which to compare the site's claimed identity.

Summary Verdict

The site presents an elevated, security-critical risk posture. Active threat-intelligence listings, a very recent origin and an unattributable operator converge on the same conclusion. Neutral technical hygiene does not offset these findings. Legitimacy cannot be inferred from the available evidence.

Infrastructure Integrity

Every observed address belongs to the CDN's edge network, and the origin server was not observable. Independent attribution of the real hosting location is therefore not possible. The edge protection and bot challenge in front of the site are a limited mitigating factor. They reduce direct exposure of the host, but they do not vouch for the content, and they cannot offset the reputation risk. The TLS certificate confirms that traffic is encrypted. It does not confirm that the operator is trustworthy.

Closing Assessment

Interaction beyond passive viewing is not appropriate. No login, credential entry, payment, wallet connection or file download should take place on this domain, and any message or advert that directed a user here should be treated as suspect and reported. Only a verified clean reputation and a reliably established operator identity would justify reassessment.