Is m-dioneprotocol.pages.dev a scam? TrustSniffer's high-risk assessment: 5/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

The domain m-dioneprotocol on Cloudflare's free Pages hosting is a newly created, protocol-branded web property. Its apparent purpose is to present itself as the web front end of a crypto or decentralized-finance protocol. Automated access returned only a short interstitial headed "Suspected Phishing", so no product pages, legal pages or business description were retrievable. The brand-style hostname on a free shared hosting subdomain, together with the active threat listings below, matches the profile of a throwaway front end used to solicit visitors rather than an established operator's own web presence.

Scam/Impersonation Risk

The assessment is clearly cautionary. A major browser safe-browsing service currently flags the domain for social engineering, and multiple independent security engines classify it as malicious, including several widely deployed enterprise-grade engines. These listings are corroborated by a prior phishing association in historical records and by the interstitial returned on the homepage, so the site is blacklisted by several independent sources. No conflicting legal entities were found and no specific brand impersonation was confirmed, so the risk rests on the threat listings rather than on identity contradictions. The domain is young and has a very thin archival record, which gives no history of legitimate operation to offset the listings. Behavioral testing recorded a heavy volume of third-party network calls, including a handful of outbound data submissions to third-party services, along with repeated console errors and large post-load page changes. All of these went to destinations classed as known and benign, and no wallet-drainer, clipboard-hijack, hidden-form or credential-exfiltration behavior was observed. That absence is a mitigating detail, not evidence of safety, because the page content never rendered in full and any malicious payload could be served selectively. Evidence:

• Homepage: the only content retrieved was an interstitial titled "Suspected Phishing", which also blocked full page capture.
• Reputation: a browser safe-browsing service lists the domain under a social-engineering threat category, and eight security engines flag it as malicious.
• Domain provenance: about 1.8 years old, with 5 archive snapshots from December 2024 to February 2025 (2 calendar years touched).
• Behavioral testing: 119 external fetch/XHR requests and 4 external POSTs across 3 runs, all to whitelisted destinations, with no wallet or clipboard abuse detected.

Regulatory Verification Notes

No licensing, registration or legal-entity information could be assessed. The only content retrieved was the threat interstitial, so there were no terms, privacy or about pages to read. No third-party broker or regulatory-database record matched the site, and no regulated status is attributed to it. This note is limited to licensing status. The domain's reputation is addressed above, and the absence of a regulatory record is not by itself treated as evidence of wrongdoing. The technical profile shows a valid but low-assurance setup: a domain-validated certificate says nothing about who operates the site. Evidence:

• Hosting: served from AS13335 (Cloudflare, Inc., US), registry ARIN.
• Transport encryption: TLS certificate issued by WE1 (DV, domain-validated only), valid to 2027-01-07.
• Third-party registries: no broker or regulatory-database match was found for the site.

What to Verify Next

Any claim of association with a named protocol should be checked against that protocol's officially published domain, obtained from an independent, trusted source (for example, a known-good bookmark or the project's verified social and documentation channels) and not from links on this site. If the site presents itself as a regulated or licensed financial service, the claim should be confirmed directly with the relevant regulator's public register, using contact details found independently. Official support and contact channels should be confirmed through an independent route before any correspondence. If the domain was reached through a message, advertisement or social post, the sender should be treated as potentially compromised and the message reported. Evidence:

• Hostname: the brand-style name on a free shared hosting subdomain, not a standalone registered domain, cannot be assumed to belong to the protocol it resembles.
• Homepage: no legitimate operator, licensing or contact information could be observed.
• Threat listings: both the safe-browsing flag and the multi-engine detections are current.

Summary Verdict

The overall posture is high risk. The convergence of active browser-level and multi-engine malicious listings with a young domain, an unverified operator and unrenderable content places this site firmly in the cautionary category. Technical hygiene does not outweigh the reputational evidence, and the operator's identity is entirely unverified.

Infrastructure Integrity

The site sits entirely behind Cloudflare's CDN and WAF, and every observed address is an edge node, so the origin server is not observable. Bot-challenge protection was active during testing. These protections are mitigating only: they show competent edge configuration, but they cannot offset the external threat listings, and they prevent independent verification of the true hosting origin.

Closing Assessment

Account logins, credential entry, wallet connections and any financial or token transactions should be avoided entirely, and nothing should be downloaded or approved on this site. Passive viewing is the only tolerable use, ideally from an isolated browser. Anyone who has already interacted with the site should rotate relevant credentials and review wallet permissions.