Is innovateprotoclls.pages.dev a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a project hosted on a free subdomain of a developer web-hosting platform, with no custom domain of its own. When it was assessed, it presented a security interstitial headed "Suspected Phishing" instead of any business content, product pages, or branding. No product, service, or business model could be established from the site itself. Its apparent function is that of an unbranded, disposable web property of unknown purpose.

Scam/Impersonation Risk

Contradictory signals are present and weigh decisively against the site. Multiple independent security engines, including two tier-one vendors, currently flag the domain as malicious, and it is blacklisted in external reputation sources. The hosting platform's own interstitial describes the site as suspected phishing, and historical records also associate the domain with phishing. No brand impersonation or conflicting legal identities were established, because no identity content could be observed. The block is nonetheless the principal risk indicator, and it coincides with a very young, free-subdomain footprint, a pattern common to throwaway phishing and malware infrastructure. The behavioural sandbox found no wallet-connection prompts, clipboard manipulation, hidden forms, or credential posts to external destinations. This does not offset the reputation findings, because the page content was gated and little was exposed to inspect. Evidence:

• Homepage: the page served an interstitial titled "Suspected Phishing" instead of site content.
• External reputation: nine engines rate the domain malicious and one suspicious, including two tier-one vendors, and a blacklist hit is confirmed.
• Homepage behaviour: 15 cross-origin XHR calls and 5 cross-origin POSTs, with external traffic peaking at about 93.5% of requests, all to allow-listed destinations. 14 console errors were logged and no wallet, clipboard, or hidden-form abuse was observed.
• Domain provenance: registered about 2.1 years ago, with 4 archive snapshots spanning 2024–2025 (2 years tracked).

Regulatory Verification Notes

No legal, terms, privacy, or about pages could be assessed, because the only content captured was the interstitial. The site therefore makes no licensing, registration, or company-identity claims to evaluate. Operator ownership and governance remain opaque, and the real-world identity behind the domain is unverified. Third-party broker databases hold no record matching this site, so there is no reputational context from that source. The reputation findings above, not any regulatory gap, drive the risk assessment. Evidence:

• Homepage: no company name, licence, or registration disclosure was observable on the captured page.
• Hosting: served from AS13335 (Cloudflare, Inc., US).
• Transport encryption: the TLS certificate was issued by WE1 (DV), valid to 2027-01-08. A certificate of this type proves only domain control and says nothing about operator identity.
• Broker databases: no match was found.

What to Verify Next

Anyone who received a link to this domain should establish through an independent route who sent it and why. If the link was presented as coming from a known company, project, or service, confirm with that organisation using contact details obtained independently of the message. Do not rely on contact details inside the message. If the sender claims a regulated financial or investment activity, check the claimed licence in the relevant regulator's public registry. Security teams should block or monitor the domain and re-evaluate it only if the threat-intelligence listings are formally cleared. Confirm any official support or contact channel offline before relying on it. Evidence:

• Homepage: the platform interstitial gave no operator or contact information for follow-up.
• External reputation: the active malicious listings remain unresolved.
• Domain provenance: the free-subdomain form means the domain itself carries no brand or organisational context.

Summary Verdict

The assessment is a high-risk, clearly cautionary posture. Active threat-intelligence detections and a confirmed blacklist hit outweigh the technically sound transport security and the absence of overtly abusive runtime behaviour. The operator's identity is unestablished, and the available evidence gives no basis for treating the site as legitimate.

Infrastructure Integrity

The site sits behind a mainstream CDN and WAF, with bot-challenge protection active. All four observed addresses are CDN edge servers, and the origin host could not be observed. This is a mitigating factor only. It shows ordinary, reputable hosting hygiene, but it prevents independent verification of the true host and does not counter the active external threat detections.

Closing Assessment

The site should be treated as unsafe for any sensitive interaction. Accounts, credentials, payment details, wallet connections, and file downloads should not be entrusted to it. Any link to it received by message or email should not be followed further and should be reported to the platform and internal security channels.