Is frogs-98r.pages.dev a scam? TrustSniffer's high-risk assessment: 0/100

Overview

Defrogs is a single-page website served from a shared subdomain of a free static-hosting platform. Its homepage presents a short page of roughly one screen of text under the title "Defrogs", which suggests a small DeFi-style or token-themed project. No product descriptions, corporate identity, or service terms could be extracted from the page, so the site's purpose and business model are unclear from its own content.

Scam/Impersonation Risk

The assessment is clearly cautionary because contradictory signals are present. Several independent threat-intelligence engines currently flag the site as malicious or suspicious, and the site is blacklisted on external reputation lists. The infrastructure was also scored by the same external checks as clean, so the adverse listing stands on its own. The signals are not attributed to a specific attack type. No brand impersonation and no conflicting legal identities were observed, and the homepage shows no confirmed phishing form. Behavioral testing of the homepage found no wallet-connection prompts, no wallet-drainer behavior, no clipboard manipulation, no hidden forms, and no content cloaking. The page does generate unusually heavy third-party traffic. Most of its network activity goes to external hosts, including a large volume of outbound data requests and repeated outbound POST submissions. A few of the contacted external hosts are not recognized as common services. The page also logged repeated script errors during rendering. This pattern is typical of template-built or hastily assembled pages that pull in many external resources. It does not prove malicious intent, but combined with the reputation listings it justifies treating the site as hostile until cleared. Evidence:

• Homepage: external threat-intelligence engines report 3 malicious and 2 suspicious detections against the domain, and it is on an external blacklist.
• Homepage behavioral sandbox: 78 external XHR/fetch requests and 12 external POSTs across 3 runs. External requests reached up to 83% of traffic, and 3 requests went to non-whitelisted hosts.
• Homepage behavioral sandbox: 11 console errors recorded. No wallet-connect, clipboard-write, hidden-form, or cloaking behavior was detected.
• Domain provenance: registered about 2024 (~2.35 years old). The web archive holds only 3 snapshots across 2024–2026 (first seen 2024-06-21, last seen 2026-08-04, longest gap 2 years).

Regulatory Verification Notes

The homepage that could be analysed discloses no operating company, license, registration number, or legal terms. Ownership of the domain is also not identified, and the site runs on a subdomain of a shared hosting platform rather than an independently registered domain. This is ownership opacity. It is not an identity contradiction, since only one page was captured and no conflicting legal entities appear. No third-party broker or regulator database records match this site, so no regulatory standing can be inferred. The site's real-world operator has not been independently verified. The valid transport encryption is a basic hygiene signal only. It is domain-validated, so it confirms control of the domain and says nothing about who operates the site or whether it is legitimate. Evidence:

• Homepage: no company name, license, registration number, or terms of service appears in the captured content.
• Transport encryption: TLS certificate issued by WE1 (DV), valid to 2026-12-25, with Subject Alternative Names present.
• Hosting: served from AS13335 (Cloudflare, Inc., US).
• Third-party broker database: no matching record for this site.

What to Verify Next

Before any engagement, the operator should be required to prove who they are through an independent channel. That means obtaining a named legal entity and any claimed license, then confirming both directly with the relevant registry rather than through links on the site. Any official social, support, or documentation channels should be confirmed through an independent, offline route. If the project claims a token or smart contract, the contract address should be checked against an independent blockchain explorer and an audit report from a known third party. The domain listings should be re-checked later to see whether the flags are cleared or confirmed. Evidence:

• Homepage: no named operator or contract references could be extracted from the captured text.
• Reputation listings: the adverse detections were active at analysis time.
• Domain history: only three archive captures exist, so there is no long track record to rely on.

Summary Verdict

The site carries an elevated, high-risk posture. Active adverse reputation findings outweigh the technically sound transport security and the absence of overtly malicious on-page behavior. Its identity cannot be tied to any verifiable operator, and its short, thin history provides no counterweight to those findings.

Infrastructure Integrity

The site is delivered through Cloudflare's CDN/WAF, and every observed address belongs to the provider's edge network. The origin server is not visible, so independent verification of the actual hosting is not possible. This arrangement is a mitigating factor for availability and basic exposure only. It does not indicate legitimacy, and it cannot offset the reputational findings. Edge-only visibility also means that content can be changed quickly without any change in observable infrastructure.

Closing Assessment

Interaction should be limited to passive viewing in an isolated environment. Accounts should not be created, credentials entered, wallets connected, or payments and transfers made. Nothing should be downloaded from the site. Any decision to engage further should wait until the reputation listings clear and the operator is independently confirmed.