Is join-nyanheroes.pages.dev safe? TrustSniffer's low-trust assessment: 50/100

Overview

This website is a single-page promotional or onboarding site, apparently themed around a "Nyan Heroes" community. It is hosted on a free subdomain of a developer web-hosting platform rather than on a dedicated brand domain. When the site was captured, the visitor-facing response was an interstitial warning page titled "Suspected Phishing", not substantive site content. The visible page held only a small amount of text. The site's apparent purpose is to funnel visitors into a join or sign-up flow, and no products, pricing or business model are presented.

Scam/Impersonation Risk

Contradictory signals are present, and they are the decisive factor in this assessment. Multiple independent threat-intelligence engines flag the domain as malicious or suspicious, and an external blacklist hit is confirmed. The hosting platform's own interstitial describes the page as suspected phishing. These signals describe the site's reputation and are not proof of a specific attack mechanism. No brand impersonation or conflicting legal identities were established. The browser-behaviour testing found none of the usual drainer mechanics: no wallet-connection prompts, no clipboard manipulation, no hidden forms and no credential forms posting to outside parties. These clean behavioural results do not offset the blacklist listing. The page loads almost all of its activity from external sources, and it produced repeated console errors and a large burst of page-structure changes after interaction. That pattern fits a thin shell page that assembles its content dynamically, and it makes the real destination of any "join" action hard to judge in advance. A free shared-platform subdomain with a themed name is also a cheap, disposable format that is commonly used for lure pages. The site should be treated as high-risk for any sensitive action. Evidence:

• Homepage capture: the hosting platform returned a warning interstitial titled "Suspected Phishing" in place of the site content, with an access-denied response status.
• Reputation sources: two engines rated the domain malicious and one suspicious, alongside a confirmed external blacklist listing.
• Behavioural testing (three successful runs): about 97% of page activity was external, with 51 external background requests and 11 console errors, and a DOM-mutation spike of 1,508 after interaction.
• Domain provenance: roughly 2.1 years old, with 13 archive snapshots spanning 2024–2025 (2 years tracked).

Regulatory Verification Notes

The captured material gave no legal entity name, licence or registration reference, or terms and policy pages. It therefore gives no basis for linking the site to a real-world operator. The site's operator identity remains unverified, and operator and governance details are opaque. That is a verification gap, and by itself it is not evidence of fraud. Here it compounds the reputational findings: a "join" funnel with no accountable party identified gives a visitor no recourse. The shared-platform subdomain also gives no independent registrant record that could stand in for an on-site disclosure. No third-party broker or regulatory-database entry matched this site, so there is no external licensing signal in either direction. Evidence:

• Homepage capture: contained no operator name, jurisdiction, licence number or legal pages.
• Hosting: served from AS13335 (CLOUDFLARENET, US) on a shared platform subdomain, so no standalone registrant is associated with the site.
• Transport security: a valid DV TLS certificate issued by WE1, valid to 2026-11-27 (about 31 days remaining). DV validation confirms control of the domain only and says nothing about the operator.

What to Verify Next

Treat the site as unverified until its operator is confirmed through channels that do not depend on the site itself. Locate the "Nyan Heroes" project's official website, social accounts and announcements independently, and check whether they reference this address. If the project's own channels do not list this domain, treat it as unaffiliated. Confirm official support and contact channels the same way. If a licensed or regulated service is claimed, check the relevant registry directly. Evidence:

• Homepage: no operator or affiliation statement exists to cross-check against the project's official channels.
• Reputation findings: the blacklist and malicious ratings should be re-checked after any claimed remediation before the site is treated as cleared.

Summary Verdict

The deterministic assessment places this site in a low-trust, elevated-risk posture. Confirmed external threat detections and a platform-level phishing warning outweigh the neutral and mildly positive technical signals, such as clean browser-behaviour tests and a valid certificate. The operator remains unidentified, so legitimacy cannot be presumed.

Infrastructure Integrity

The site is delivered through Cloudflare's CDN and web application firewall. All four observed addresses are Cloudflare edge servers in the US, and the origin server was not observable. This protection mitigates direct exposure of the origin but gives no assurance about the operator. Edge-only visibility prevents independent verification of where the content is really hosted and can mask rapid content changes. The bot challenge that blocked capture is consistent with this gating.

Closing Assessment

Read-only viewing is the most this site warrants. Do not sign in, submit credentials, connect a wallet or make any financial transaction through it, and do not download files from it. Anyone who has already interacted with it should treat any credentials or wallet permissions they shared as potentially exposed.