Is kangamoon.pages.dev safe? TrustSniffer's low-trust assessment: 50/100

Overview

The website is a single-page presence served from a free shared-platform subdomain on Cloudflare's Pages hosting service. Its homepage carries the bare title "home" and a moderate amount of text. The captured content does not establish a named product, brand or service, so its business purpose is unclear. The only identifier is a developer-platform subdomain, with no standalone domain or corporate branding behind it.

Scam/Impersonation Risk

The principal concern is reputational and objective. More than one independent threat-intelligence engine classifies the domain as malicious, and a further engine marks it suspicious, so the site is blacklisted on the strength of those detections. This is a confirmed adverse listing rather than a soft signal, and it is the decisive factor in the assessment. No brand impersonation, conflicting legal identities or phishing-kit indicators were established from the captured page. The risk therefore rests on the third-party detections rather than on proven content-level deception. Behavioural testing of the homepage showed none of the typical credential- or asset-theft mechanics. There was no wallet-connection prompt, no wallet-drainer activity, no clipboard manipulation, no hidden or externally posting password forms, and no cloaking after interaction. The session did show heavy outbound traffic to third parties, including dozens of background requests and a number of outbound POST submissions. It also produced a very high volume of script errors, which suggests an unpolished or unstable build. A few of the contacted external endpoints fall outside commonly recognised services. Together with the blacklist, this means the benign behavioural result cannot offset the reputation risk. Evidence:

• Homepage: multiple threat-intelligence engines flag the domain as malicious, and at least one more as suspicious, which triggers the confirmed blacklist classification.
• Homepage behaviour: three of three test sessions completed with normal responses, and no wallet, clipboard, hidden-form or cloaking behaviour was recorded.
• Homepage behaviour: 78 external background requests, 12 external POST submissions and 89 console errors were logged, with 3 requests going to non-whitelisted destinations.
• Domain provenance: the domain is about 2 years old, with a first archive capture on 2024-09-27.

Regulatory Verification Notes

No regulator, licence or registration reference was identified for the site. The captured homepage does not tie the site to a named operating entity. Because of this, the real-world operator behind the site has not been independently verified, and nothing on the page supports a claim to regulated status. No third-party broker or regulatory-database entry matched the site, so there is no external reputational signal to weigh in either direction. This gap concerns verification only. The adverse conclusion rests on the blacklist detections described above, not on the missing disclosures. Technical hygiene is basic but present. The site uses a valid, domain-validated TLS certificate from a recognised issuer. This protects the transport channel but says nothing about who operates the site or whether it is benign. Evidence:

• Homepage: no operator name, licence number or registration reference appears in the captured content.
• Transport encryption: TLS certificate issued by WE1 (DV), valid to 2026-12-04, with about 38 days remaining.
• Web archive: 18 snapshots spanning 2024–2025 (2 years tracked), indicating a short but continuous history.

What to Verify Next

Any party considering engagement should first establish who operates the site and whether the claimed brand, if any, actually controls this address. That means obtaining the operator's identity and any licence details through an independent, offline route, for example by contacting the supposed organisation through channels published outside this site. The blacklist status should then be checked directly with the listing engines for this exact address, to see whether the detections are current and whether the owner has remediated or disputed them. Until both points are resolved, the site should not be treated as a legitimate counterparty. Evidence:

• Domain structure: the address is a subdomain on a shared hosting platform, so any claim of corporate ownership needs separate confirmation.
• Reputation status: the adverse detections come from several engines, so each should be reviewed individually for date and category.

Summary Verdict

The deterministic assessment places the site in a low-trust, elevated-risk posture. Confirmed adverse threat-intelligence detections drive that outcome. The absence of observable on-page deception and the presence of basic technical hygiene do not counterbalance those detections. The operator remains unidentified, so legitimacy cannot be assumed.

Infrastructure Integrity

The site is served entirely through Cloudflare's CDN/WAF (AS13335, Cloudflare, Inc., US), with four edge addresses observed and no origin server visible. This provides ordinary availability and traffic-filtering protection and is a mitigating factor only. It does not offset the reputation risk. Because only edge addresses can be seen, the underlying host cannot be independently verified, and page content could be changed quickly without any visible infrastructure change.

Closing Assessment

Login, credential entry and any financial interaction should be avoided, and nothing should be downloaded from the site. At most, it should be viewed passively from a protected environment until the threat detections are cleared and the operator is credibly identified.