Is hibachiclaim.pages.dev a scam? TrustSniffer's high-risk assessment: 17/100

Overview

This website is a single-page project published on a shared, free-tier developer hosting subdomain. Its hostname is worded as a "claim" page, a naming pattern commonly used for reward, airdrop or giveaway offers. Visitors do not reach ordinary site content. They are met by a security interstitial that labels the page as suspected phishing. No operator name, product description or business model could be established from the page itself.

Scam/Impersonation Risk

The evidence shows elevated, corroborated risk. The site appears on an external blacklist, and independent reputation sources return one malicious and two suspicious detections for it. The hosting platform's own challenge page names the destination as suspected phishing, and the homepage refused automated access outright. A claim-style hostname combined with a phishing warning fits the profile of a lure that moves visitors toward a reward-claim, wallet-connection or credential-entry step. This analysis found no such step: the sandbox observed no wallet-connection prompts, clipboard tampering, hidden forms or password forms posting to outside parties. That limits what has been observed, but it does not clear the site, because the interstitial prevented the real page content from being examined. No conflicting legal identities and no brand impersonation were confirmed. The adverse conclusion rests on the blacklist listing and the reputation detections, not on a proven impersonation of a named brand. Evidence:

• Homepage: access was refused with a forbidden response and replaced by an interstitial titled as suspected phishing.
• Reputation: the site is on an external blacklist, with one malicious and two suspicious detections, and no detection from the major browser safe-browsing service.
• Sandbox behaviour: three successful runs found no wallet-connect activity, clipboard writes, hidden forms or externally posting password forms.

Regulatory Verification Notes

No legal, terms, about or licensing pages could be retrieved, so no licensing status, registered entity or regulatory standing can be assessed for this site. No third-party broker or regulator-style record matches the name. That absence is not a regulatory verdict, and the risk finding above does not depend on it. The transport-layer facts are routine and carry no weight toward legitimacy. A valid certificate is cheap to obtain and does not show who operates the site. Evidence:

• TLS certificate issued by YE1 (domain-validated only), valid to 2026-12-16 (50 days remaining).
• Served from AS13335 (Cloudflare, Inc., US).
• No matching entry was found in the third-party broker reputation dataset.

What to Verify Next

Anyone who received this link should confirm through an independent, offline route with the party that supposedly issued the offer. That means contacting the claimed brand directly through its known official website or support channels, not through anything linked from this page. The "claim" being offered should be checked against that brand's own announcements. If the link arrived by message, email or social post, the sender's account should be checked for compromise. Any organisation that observes the link in its environment should treat it as a suspected phishing destination and report it to its security team and to the hosting platform's abuse process. Evidence:

• The captured homepage text was very short (381 characters), too little to substantiate any legitimate offer.
• The hostname sits on a shared hosting namespace rather than an independently registered brand domain, so the address alone gives no assurance of affiliation.
• During interaction, up to 94.8% of requests went to external destinations: 21 external data requests and 5 external posts, all to recognised services. The page also logged 16 console errors and 857 page-structure mutations.

Summary Verdict

The overall posture is high risk. Corroborated adverse reputation signals and a platform-level phishing warning outweigh the technically orderly delivery. The site's real-world operator and purpose remain unestablished, and the evidence does not support treating it as a legitimate service.

Infrastructure Integrity

The site is delivered through Cloudflare's CDN and WAF. All four observed addresses are edge servers in a recognised US network, with no origin server visible. A bot-protection challenge is active. This setup is a mitigating factor only: it shows professional delivery infrastructure, not the legitimacy of the content behind it, and it cannot offset the adverse reputation findings. Shared edge infrastructure also means the hosting itself is not independently attributable to the operator.

Closing Assessment

Interaction with this site should be avoided. That includes opening claim flows, connecting wallets, entering credentials or payment details, and downloading files. Anyone who has already engaged should change any reused passwords and review wallet approvals and account activity without delay.