Is fpxy.pages.dev a scam? TrustSniffer's high-risk assessment: 22/100

Security Alert

Fortinet flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a project hosted on a free, shared-platform subdomain at a major edge-hosting service. Visitors do not reach any identifiable product, brand or service. The only content presented is a short security interstitial titled as a suspected-phishing warning, served behind a bot-challenge gate. The site's apparent purpose and business model cannot be established from anything it shows, and its operator is not connected to any real-world brand or person.

Scam/Impersonation Risk

Contradictory signals are present, and they are material. The domain is blacklisted: multiple independent security engines classify it as malicious or suspicious, including a tier-one network-security vendor, and a separate external blacklist signal corroborates this. The page a visitor receives is itself a suspected-phishing warning, and the domain carries a prior phishing association in historical records. These findings do not by themselves prove a specific impersonated brand. No brand impersonation or conflicting legal identities were observed, and no contact address with an anomalous domain was published. The behavioural profile is mixed. Automated sessions found no wallet-connection prompts, clipboard manipulation, hidden or credential-harvesting forms, or suspicious inline scripts, and all external requests went to recognised destinations. The page nonetheless generated a heavy volume of third-party requests relative to its size, along with repeated client-side console errors, and the infrastructure shows fast-rotating, ephemeral DNS characteristics. Together these are consistent with a short-lived or disposable deployment. The reputation findings outweigh the benign behavioural results, because threat listings reflect what the site has actually been seen doing. Evidence:

• Homepage: the visitor-facing page is a warning interstitial headed as suspected phishing, and automated capture was blocked by a bot challenge.
• Reputation: several independent engines flag the domain as malicious or suspicious, and an external blacklist is active.
• Domain provenance: about 1.8 years of registration continuity, with only 2 archive snapshots between December 2024 and August 2026 (3 years tracked, a 2-year maximum gap).
• Behaviour: no wallet-drainer, clipboard-hijack or external credential-form activity in three successful runs, but 24 third-party XHR requests and 17 console errors on a page with about 380 characters of text.

Regulatory Verification Notes

No licence, registration number, company name or legal page could be assessed, because the site presents only the warning interstitial. Nothing connects this domain to a regulated or registered entity, and no third-party regulatory or broker record matched it. This is a verification gap rather than evidence of wrongdoing, and the elevated risk rests on the reputation findings above. Registration details are incomplete, which points to ownership opacity and not to an identity contradiction. The site runs on a shared-platform subdomain, so the domain gives no independent evidence of who operates it. A valid transport-encryption certificate is in place, but a domain-validated certificate only confirms control of the domain and says nothing about the operator's legitimacy. Evidence:

• Transport security: TLS certificate issued by WE1 (DV), valid to 2027-01-01.
• Hosting: served from AS13335 (CLOUDFLARENET, Cloudflare, Inc., US).
• Identity: no operator, legal entity, licence or registration details were observable on the homepage.
• Third-party broker coverage: no matching broker or regulatory-reputation record.

What to Verify Next

Anyone who received a link to this site should confirm with the party who sent it, through an independent route such as a known phone number or a previously trusted channel, that the link is genuine and was intended. If the site claims to represent a particular company, that company should be asked through its official, independently sourced website whether it operates this address. If the site is represented as a financial or investment service, the claimed operator's licence should be checked directly with the relevant regulator's public register. The domain's reputation status should be re-checked after any remediation by the owner before the assessment is revisited. Evidence:

• Homepage: no company name, licence or contact route is presented to check against.
• Reputation: the current threat listings and the platform's own phishing warning are the standing basis for caution.
• Registration: the shared-platform subdomain provides no independent ownership anchor.

Summary Verdict

The evidence converges on a high-risk posture. Active malicious or suspicious classifications, a platform-level phishing warning, and an unidentified operator outweigh the technically sound transport encryption and the absence of overtly hostile page behaviour. The site is not apparently legitimate, and its real-world operator is not identified.

Infrastructure Integrity

The site is delivered through a major CDN and WAF, and all observed addresses are edge servers. The origin server was not observable, so the real hosting location cannot be independently verified. The edge infrastructure and bot protection are reputable and mitigate direct exposure, but they are protective tooling and do not establish the legitimacy of the content behind them. They cannot offset the reputation findings.

Closing Assessment

Treat the site as unsafe for login, credential entry, payments or any financial interaction, and do not download or run anything from it. Any visit should be limited to passive viewing, ideally from an isolated environment. Anyone who has already entered credentials or payment details should change those credentials and notify the relevant provider.