Verdict
This assessment found strong scam indicators. Do not pay, sign in, or share personal details with this site.
hydrawin-dapp.pages.dev shows high-risk / scam indicators.
Evidence status and limitations
Evidence completeness: Not recorded
- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.
At a glance
The checks that decide most of this verdict.
| Malware engines | 11 flagged itVirusTotal | Risk |
|---|---|---|
| Google Safe Browsing | Not listedGoogle | Clear |
| Abuse reports on the host | 0% confidenceAbuseIPDB, 0 reports; shared hosting inflates reports | Clear |
| Domain age | 2.0 years oldRegistered history | Clear |
| Web archive | Archived since 20243 snapshots | Clear |
| Certificate | Encrypted connectionIssued by WE1 | Noted |
The page as captured
Key findings
- Automated classification: Sensitive Interaction Risk.
- Domain age: 1 to 3 years (registration continuity).
- Public web-archive history exists since 2024.
- At least one reputation service TrustSniffer consulted had flagged this domain at assessment time.
Full analysis
Security Alert
Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.
This is a web application front end on a free, shared subdomain of a developer site-hosting platform. The hostname suggests a decentralized-application (dApp) or crypto-gaming service. The page content could not be rendered for inspection. Automated access was met with an access-denied bot challenge titled "Suspected Phishing", so the site's actual offer, products and business model are not observable. The site is about two years old, and its purpose cannot be confirmed from the captured evidence.
Scam/Impersonation Risk
Contradictory signals are present and weigh heavily against the site. Several major security vendors independently classify it as malicious. One further engine rates it suspicious, and an external blacklist listing is confirmed. The hosting platform's own interstitial describes the page as suspected phishing, which matches these detections. No conflicting legal identities or brand-impersonation claims were identified, because no page content was captured. The risk therefore rests on the confirmed blacklisting and the phishing characterization, not on observed content. Behavioral testing recorded no wallet-connection prompts, wallet-drainer routines, clipboard manipulation, hidden forms or external password forms. The testing also found no non-whitelisted external requests. This does not offset the reputation findings, because the blocked page prevented full interaction with the real application. The sessions did show heavy third-party traffic, with nearly all observed requests going to external destinations. They also showed repeated script errors and large page-structure changes after interaction. This pattern fits an application that loads most of its logic and data from elsewhere, which makes a later content swap easy.
- Homepage: access was refused with a 403 status and a bot challenge titled "Suspected Phishing", so no site content could be reviewed.
- External reputation: 11 malicious and 1 suspicious detections, including detections from three leading security vendors, and a confirmed external blacklist listing.
- Behavioral sessions on the homepage: 52 external data requests and 5 external form submissions, none to non-whitelisted destinations; 15 console errors and 1,508 page mutations after interaction.
- Web archive: 3 snapshots spanning 2024-11 to 2025-03 (2 years tracked), so the history is thin, and the domain shows about 2 years of registration continuity.
Regulatory Verification Notes
No licensing, registration or regulated-entity status is associated with this site. No third-party broker or regulatory-registry entry matches it. The captured evidence shows no legal, terms or about pages that name an operating company, so no operator could be linked to the site. The real-world operator is not independently tied to any brand or person, and ownership is opaque. Registering on a shared platform subdomain gives no entity-level accountability. Any financial, gaming or token-related activity on this site would sit outside any identifiable supervisory perimeter. The transport-layer facts below do not establish the operator's legitimacy. The site presents a valid domain-validated TLS certificate, which only proves control of the hostname.
- Hosting: served from AS13335 (Cloudflare, Inc., US).
- TLS: certificate issued by WE1 (DV, domain validation only), valid to 2027-01-18.
- Site pages: no company name, registration number or licence reference could be obtained from any captured page.
- Decentralized-finance recognition: the domain is not listed as a recognized protocol.
What to Verify Next
Nothing the site offers should be relied on until its blacklist status is cleared. If the site is expected to belong to a known project, its official address should be confirmed through the project's own announcements or a trusted offline source, and compared character by character with this hostname. Official support channels should be confirmed independently. Any claim of licensing or audit should be checked directly with the named registry or auditor. The hostname should be rechecked with the security vendors and the hosting platform to see whether the listing has been resolved or the content changed.
- Hostname: a free shared-platform subdomain with a "dapp" naming pattern, which can be copied by others and offers no brand assurance.
- Reputation: current vendor and blacklist listings are active at the time of analysis.
- Archive: only three historical captures exist, so there is little prior legitimate content to compare against.
Summary Verdict
The site carries an elevated risk posture. Multiple security vendors independently flag it as malicious, and it is confirmed on an external blacklist. Technical hygiene and a short, thin archive history do not offset these findings, and no independent identity link exists to support any assumption of good faith. Treat it as a high-risk, unverified destination.
Infrastructure Integrity
The site sits behind a major CDN and web application firewall. All four observed addresses are provider edge servers, and the origin server is not observable. Behavior tests also recorded bot-protection challenges. This protection is a modest mitigating factor, and it also prevents independent verification of where the content is really hosted. It cannot offset the reputation findings, and it does not show that the site is legitimate.
Closing Assessment
The site should not be used for logins, wallet connections, credential entry or any payment or transfer. If it must be examined at all, it should be viewed read-only, in an isolated environment, and with no downloads. Anyone who has already interacted with it should treat any exposed credentials or wallet approvals as compromised and revoke or change them immediately.
Written analysis generated 2026-11-01 by the TrustSniffer Analysis Engine from the evidence in this report.
What the analysis found
3 findings contributed to this verdict, raised by external reputation, behaviour in a sandbox, registration and ownership.
01 External reputation
- An external threat feed lists this domain: either Google Safe Browsing marked it malicious, or a significant number of malware engines flagged it.External reputation
rule:EXT_BLACKLIST_CRITICAL
02 Behaviour in a sandbox
- Most of what the page loaded came from other domains rather than from this one.Behaviour in a sandbox
rule:BEHAV_EXTERNAL_RATIO_HIGH - The structure of the page changed sharply while it was loading.Behaviour in a sandbox
rule:BEHAV_DOM_DENSITY_SPIKE - The page produced an unusually high number of errors while it ran.Behaviour in a sandbox
rule:BEHAV_CONSOLE_ERRORS_HIGH - The page made many background requests to other domains while it was open.Behaviour in a sandbox
rule:BEHAV_EXTERNAL_XHR_HEAVY
03 Registration and ownership
- The public registration record for this domain is incomplete.Registration and ownership
rule:KF_WHOIS_INCOMPLETE
Identity verification
| Status | UNKNOWN |
|---|---|
| Identity score | 50/100 |
| Identity verification confidence | 30% |
- AI page analysis unavailable (page captured; identity not AI-verified)
Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence.
What TrustSniffer observed
First-party facts recorded during the assessment of hydrawin-dapp.pages.dev.
- The request stayed on hydrawin-dapp.pages.dev. It was not redirected to another domain. Clear
- The earliest public archive of this site is from 2024-11-12. Clear
- It is hosted on CLOUDFLARENET, from a server in US. Noted
Domain intelligence
| Registrar | Not available |
|---|---|
| Hosting | CLOUDFLARENET - Cloudflare, Inc., US |
| Country | US |
| Server IP | 2606:4700:310c::ac42:2f4a |
| Name servers | Not available |
| CDN / edge network | Detected (cloudflare) |
| Resolved IP addresses | 4 |
| Edge IP addresses | 4 |
| Likely origin IP addresses | 0 |
| SSL issuer | WE1 |
| SSL expiry | 2027-01-18 |
| Domain age | 1.97 years (continuous registration) |
| Domain expiry | Not available |
| Archive first seen | 2024-11-12 |
| Archive snapshots | 3 |
| Reputation | VirusTotal: 11 flagged | AbuseIPDB: 0% confidence, 0 reports | Google Safe Browsing: 0 matches |
About this assessment
A trust score summarises the evidence TrustSniffer could collect about hydrawin-dapp.pages.dev at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.
TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.