Is kernel-migrate.pages.dev a scam? TrustSniffer's high-risk assessment: 5/100

Overview

Kernel Protocol is a single-page website published as a subdomain on a shared static-hosting platform (Cloudflare Pages). The visitor sees a short landing page, under a thousand characters of text, titled "Kernel Protocol", which uses crypto-protocol-style naming. The captured material does not state what the project offers, so its business model and purpose cannot be determined from the site itself.

Scam/Impersonation Risk

The site is flagged by multiple independent threat-intelligence sources, which is a confirmed blacklist condition. This is the decisive finding of the assessment, and the site's technical hygiene does not offset it. A hostname on a free shared-hosting platform is cheap to create, replace and abandon, and that makes a confirmed detection more serious. The evidence does not show brand impersonation or conflicting legal identities. The behavioral sandbox runs also found no hidden forms, no externally submitted password forms, no clipboard manipulation, no wallet-drainer behavior and no content cloaking. The page makes heavy use of third-party resources, with a large share of its traffic going to external hosts. None of those hosts fell outside the known-service allowlist, so this is a minor aggravating factor and not an independent indicator of fraud. Because the detections point to harmful use or compromise but the page itself shows no overt malicious mechanics, the safest reading is that the site is hostile or compromised until the listings are cleared. Evidence:

• Homepage: independent reputation engines currently report the hostname as malicious or suspicious, and an external blacklist also lists it.
• Homepage behavioral runs: 77 external XHR/fetch requests and 3 external POST requests were observed, none to non-allowlisted hosts. Wallet-connect, clipboard-hijack and hidden-form checks were negative.
• Domain provenance: the domain is about 1.8 years old.
• Web archive: 4 snapshots spanning 2025-01-04 to 2025-03-02 (1 year tracked), with consistent content and no sign of repurposing.

Regulatory Verification Notes

The captured homepage is brief and names no legal entity, registration number, licensing authority or responsible operator. No legal, terms or about pages appeared in the captured material, so disclosure transparency on the site is unclear. No third-party broker or regulatory-database match exists for this name, so no external reputational signal on regulated status is available either way. In this case the missing disclosures matter more than they would for a clean site, because they sit alongside confirmed threat detections and give a visitor no accountable party to turn to. Identity has not been independently established, and the site's own branding should not be treated as evidence of a real-world organization. Evidence:

• Homepage: short text under the title "Kernel Protocol", with no company name, license reference or registration details.
• Hosting infrastructure: served from AS13335 (Cloudflare, Inc., US).
• Transport encryption: the TLS certificate was issued by WE1 (DV, domain-validated only) and is valid to 2027-01-14. DV validation confirms control of the hostname and says nothing about the operator's identity.

What to Verify Next

Before any engagement, check the site's current standing directly with the major threat-intelligence and safe-browsing services, to see whether the detections have been cleared. Establish who operates the project through an independent, offline route, such as an official channel of any organization the project claims to be affiliated with, and not through contact details given on the site. If the project later makes financial or investment claims, confirm any claimed authorization with the relevant national financial regulator's public register. Confirm official support and contact channels through a source independent of the site. Evidence:

• Homepage: no operator, affiliation or licensing statement is present to check against a registry.
• Threat-intelligence listings: the detections are current as of this assessment and may change if the owner remediates.
• Hosting: the shared pages.dev hostname gives no independent link between the project name and any organization.

Summary Verdict

The site is assessed at an elevated risk level. Hard reputational detections outweigh its sound technical basics, and nothing establishes the real-world identity of the operator. It should be treated as an unsafe destination for sensitive activity.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and WAF. All four observed addresses, IPv4 and IPv6, are Cloudflare edge servers, and the origin server was not observable. The valid certificate and the clean abuse history of the shared edge address are mitigating factors only. They describe the platform and say nothing about the content on it. Edge-only visibility also prevents independent verification of the true host and can mask rapid content changes, so this infrastructure cannot offset the reputation findings.

Closing Assessment

Credentials, wallet connections, payments and personal data should not be given to this site while the threat listings stand. If the page must be examined, it should be opened only in an isolated, disposable environment, with nothing downloaded from it. The assessment should be re-run after the listings are reviewed or the operator is independently identified.