Is hive-keychain.pages.dev a scam? TrustSniffer's high-risk assessment: 5/100

Security Alert

Fortinet, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a single-page web application on a free shared-hosting subdomain. Its title is "Home | Mainnet Sync app", and its address uses the name of a blockchain key-management product. It presents a short application page of roughly a thousand characters of text, and the page implies a wallet or account "sync" workflow. Its apparent purpose is to get visitors to engage with a blockchain wallet or account synchronisation flow under a recognisable crypto-tooling name, but the operator is not independently identified.

Scam/Impersonation Risk

This is the dominant concern, and the posture is clearly cautionary. Multiple independent reputation sources currently flag the site. Several engines classify it as malicious, and two major security vendors are among them. This amounts to a confirmed blacklist condition and is the decisive factor in the assessment. The subdomain borrows the name of a key-management product while sitting on a shared, publicly registrable hosting platform. A "Mainnet Sync" page presented under that name matches a familiar wallet-lure pattern, in which a victim is steered to "sync" or "restore" a wallet and discloses recovery phrases or signs malicious transactions. The evidence stops short of confirming this. No brand impersonation or phishing flag was independently confirmed, and the site's actual content could not be fully reviewed because the page was gated behind an automated-visitor challenge. In the observed sessions the page made no outbound data submissions, no wallet-connection attempts, no clipboard manipulation and no hidden forms. That absence does not neutralise the reputation hits, because such behaviour can be withheld from automated visitors or activated later. No conflicting legal identities were observed. The risk rests on the threat listings and the naming context, not on identity inconsistency. Evidence:

• Homepage and application page: multiple security engines currently rate the site malicious (9 malicious, 1 suspicious), including two tier-one vendors.
• Domain name: a key-management brand label sits under a shared free-hosting platform domain, which closely resembles the platform's own namespace.
• Application page: titled "Home | Mainnet Sync app" and served behind a bot challenge, so full content review was not possible.
• Behavioural sessions: three successful runs recorded no external submissions, no wallet-provider interaction and no clipboard writes, but did record 31 browser console errors.

Regulatory Verification Notes

The captured page names no operating company, licence, registration number or jurisdiction, so no on-site basis exists for linking it to a regulated or identifiable entity. The operator's real-world identity remains unestablished, and governance and ownership are opaque. For a site inviting wallet-related interaction, that opacity is an aggravating factor alongside the threat listings, though not proof of wrongdoing on its own. No third-party regulatory source confirms the site as a regulated entity. The legitimacy of anything presented here therefore cannot be inferred from on-page claims. Evidence:

• Application page: no legal entity, licence, registration or contact-accountability details were visible on the captured content.
• Transport layer: TLS certificate issued by YE2 (DV, domain-validated only), valid to 2026-12-04. It confirms encryption but not who operates the site.
• Hosting: served from AS13335 (CLOUDFLARENET, Cloudflare, Inc., US).

What to Verify Next

Anyone who reached this address through a link, message or advert should establish where it came from before any further interaction. The official home of the product whose name is used should be located independently, through its verified publisher listing or a known offline reference, and compared against this address. Any wallet or extension should only be obtained from the official store listing the legitimate project directs to. If wallet credentials, recovery phrases or signatures were already supplied here, the affected wallet should be treated as exposed, funds moved to a freshly created wallet, and any related approvals revoked. Official support channels for the legitimate project should be confirmed through an independent route, and the site should be reported to the hosting platform and the relevant security vendors. Evidence:

• Domain name: the address reuses a product-style label on a shared-hosting platform, so provenance must be checked against the official project.
• Application page: the "sync" framing is the interaction that most warrants out-of-band confirmation.
• Reputation listings: current third-party detections justify reporting the site for review.

Summary Verdict

The site carries an elevated, clearly high-risk trust posture. Current multi-source threat detections are decisive, and no legitimacy evidence offsets them. The operator's identity is unestablished. The site's technical hygiene, such as encrypted transport and quiet observed behaviour, is outweighed by its reputation and its wallet-themed positioning.

Infrastructure Integrity

The site is fronted by Cloudflare's CDN and WAF, and all four observed addresses, IPv4 and IPv6, are Cloudflare edge servers. The origin server was not observable, so the real hosting location cannot be independently confirmed. The platform's bot challenge also blocked full capture of the page. This protective infrastructure is a mitigating factor only. It shows the site is served through mainstream, well-run infrastructure, but it does not establish legitimacy, and it cannot offset the active threat detections. Edge-only visibility can also allow content to be changed quickly without any visible change in hosting.

Closing Assessment

The site should be treated as unsafe for any sensitive interaction. Passwords, wallet connections, recovery phrases, transaction signatures and payments should not be submitted to it, and nothing should be downloaded from it. If the page has to be examined at all, that should happen only in an isolated, non-production environment with no wallet attached.