Is fixprotocol.pages.dev a scam? TrustSniffer's high-risk assessment: 15/100

Overview

This website is hosted on a free subdomain of a developer page-hosting platform and uses the name "fixprotocol". Automated access to its homepage ended at a platform security interstitial headed "Suspected Phishing" rather than at any site content. A visitor therefore sees no readable product, company or service description, and the site's business purpose cannot be established from the evidence. The naming implies a technical or financial-protocol brand, but nothing observed confirms that.

Scam/Impersonation Risk

The evidence converges on a clearly elevated risk. Multiple independent threat-intelligence sources currently flag the domain as malicious or suspicious, and it is blacklisted on external reputation lists. The hosting platform's own interstitial describes the page as suspected phishing, which corroborates those listings. No conflicting legal identities and no brand impersonation were observed. Those conditions could not be tested, because the homepage content was never retrieved. Behavioural testing found no wallet-connection prompts, no clipboard manipulation, no hidden forms and no credential forms posting to outside destinations. These results do not offset the active listings. They only show that no drainer or credential-theft mechanics were triggered in three test sessions. The page did show heavy outside-resource loading, a large number of console errors and substantial page rewriting after interaction. This pattern is consistent with a script-driven shell that assembles its content dynamically. Evidence:

• Homepage: access ended at a 403 bot-challenge page titled "Suspected Phishing", with only a short block of text captured.
• Reputation checks: two threat-intelligence engines rated the domain malicious and one rated it suspicious, and an external blacklist also listed it.
• Behavioural sandbox on the homepage: 55 external XHR/fetch calls and 4 external POST requests, all to destinations on the known-service allowlist, with about 97% of activity at peak going to external resources.
• Behavioural sandbox on the homepage: 18 console errors and up to 1,508 DOM mutations after interaction across 3 successful runs.

Regulatory Verification Notes

No legal, terms, privacy or about pages could be assessed, so the evidence contains no licence, registration number or named operating entity. Because the site runs on a shared-platform subdomain, there is also no standalone domain registration that points to an operator, and ownership and governance remain opaque. Identity verification is unresolved. No third-party broker or regulatory record matched the site, and this absence is not a verdict on licensing. The site must not be treated as a regulated or authorised service on the strength of anything observed. Its valid transport encryption is a hygiene factor only and says nothing about the operator. Evidence:

• Hosting infrastructure: served from AS13335 (Cloudflare, Inc., US) from four edge addresses, which identifies the network but not the operator.
• Transport encryption: TLS certificate issued by WE1 at domain-validation (DV) level only, valid to 2027-01-06, with no organisation identity attached.
• Third-party broker dataset: no match for this site.

What to Verify Next

Any decision to engage should rest on evidence from outside the website. First, the operating entity and any claimed licence must be identified through the relevant financial regulator's public registry, and not through anything stated on the site. Second, the official brand domain, if the "fixprotocol" name claims one, should be confirmed through independent sources. This check should establish whether this free-subdomain address is an authorised property or a lookalike. Third, the current status of the platform warning and of the reputation listings should be rechecked, since the site's owner may have been compromised or may have cleaned it. Last, official support channels should be confirmed through an offline or independently sourced route. Evidence:

• Homepage: the platform interstitial describes the page as suspected phishing, so the warning's status is the first item to recheck.
• Domain structure: the address is a subdomain of a shared hosting platform and not an independently registered brand domain.
• Reputation checks: the listings are current at the time of analysis and may change after remediation or takedown.

Summary Verdict

The site carries a critical, high-risk posture. Active threat-intelligence detections, supported by the hosting platform's own phishing warning, outweigh the technical hygiene signals. No real-world operator can be tied to the site. The evidence does not support treating it as a legitimate or established service.

Infrastructure Integrity

The site is served entirely through Cloudflare's CDN and WAF, and all four observed addresses are edge servers, so the origin host is not visible. Protective infrastructure of this kind is a mitigating factor only. It cannot offset the reputation risk, and it prevents independent confirmation of where the content is actually hosted. Bot-protection challenges on the site fit this setup. Free-tier platform hosting also lets content be changed quickly without any change to the address.

Closing Assessment

Account login, credential entry, wallet connection and any financial or payment interaction should be avoided, and nothing should be downloaded from the site. Any contact should be limited to viewing in an isolated environment, without personal data, until independent sources confirm the operator and the listings clear.