Is Pages a scam? TrustSniffer's high-risk assessment of mainnet-resolver.pages.dev: 5/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website presents a single landing page titled "Multichain - Cross-Chain Router Protocol". It sits on a free subdomain of a shared developer-hosting platform, not on a standalone branded domain. The visible content is a short text page in the style of a cross-chain bridging or routing service. Its apparent purpose is to look like a decentralized-finance routing protocol that asks visitors to interact with blockchain assets. The page content could not be analysed in depth, so no specific products, yields or leverage claims could be extracted.

Scam/Impersonation Risk

Contradictory signals are present, and they converge on a clearly cautionary reading. The domain is confirmed blacklisted by external reputation sources. A substantial cluster of security engines flags it as malicious, including several tier-one vendors, and one further engine rates it suspicious. That is enough to trigger an automatic ceiling on the site's trust assessment. The site's name also fits a recognised lookalike pattern. It borrows the title of a known cross-chain router brand while hosted on a generic shared-platform subdomain, and a shared subdomain cannot show any link to that brand. This is a branding mismatch. Site-controlled evidence does not establish a conflicting legal identity. Sandbox behaviour was otherwise unremarkable: no wallet-connection prompts, wallet-drainer routines, clipboard manipulation, hidden forms, credential posts to third parties, or content cloaking were observed. This clean behavioural run does not offset the confirmed external detections. A page that behaves benignly during automated visits can still be used for targeted lures or later content swaps. The page also made a heavy volume of external background requests during rendering. All went to recognised destinations, but the pattern adds modest noise to the picture. Evidence:

• Homepage: the page title presents the site as a cross-chain router protocol under the Multichain name while served from a shared-platform subdomain.
• External reputation: a large group of security engines, including several tier-one vendors, flag the domain as malicious, and it is blacklisted.
• Domain provenance: first observed in 2024, roughly 2.2 years old, with 55 archive snapshots spanning 2024–2026 (3 years tracked) and no sign of repurposed content.
• Sandbox: three of three browser runs completed with no wallet-drainer, clipboard-hijack, hidden-form or cloaking behaviour, and 74 external background requests were made.

Regulatory Verification Notes

The captured page discloses no operating company, licence, registration number or governing jurisdiction. Because the captured content was limited, this is a gap in what was observed and not a finding about the operator. No third-party broker or regulator record matched the site, and none attests to its legitimacy. Identity could not be independently tied to any real-world entity or to the brand named in the page title. The transport layer is technically sound, but that says nothing about operator legitimacy. Domain-validated certificates are issued automatically to any controller of a domain. Evidence:

• Homepage: no company name, licence, registration number or legal-entity disclosure is visible.
• Hosting: served from AS13335 (Cloudflare, Inc., US).
• Transport encryption: TLS certificate issued by WE1 (DV), valid to 2026-12-28, with a SAN list present.
• Broker reputation database: no matching record.

What to Verify Next

Before any engagement, the claimed brand should be matched against its official domain, published through channels independent of this page, such as the brand's verified social profiles or documentation. Any claim of licensing or protocol operation must be checked against the relevant registry. Any wallet address or contract on the page must be confirmed independently before funds are sent. Official support and contact channels should be established through an offline or separate route. Evidence:

• Homepage title: it names a specific protocol brand that must be matched to that brand's official domain.
• Hosting: the shared-platform subdomain is a different class of address from a project's own registered domain.
• Reputation: the external detections should be re-checked before any interaction is reconsidered.

Summary Verdict

The overall posture is high risk and clearly cautionary. External threat detections are decisive and outweigh every mitigating technical attribute. Identity remains unverified, and the site cannot be treated as a legitimate counterpart on the evidence available.

Infrastructure Integrity

The site is fronted by Cloudflare's CDN and WAF, and all four resolved addresses (IPv4 and IPv6) are edge nodes. The origin server was not observable, so independent verification of the underlying host is not possible, and edge-only visibility can mask rapid content changes. The protective layer and trusted network provider are mitigating factors only. They do not offset the reputation findings, because the same infrastructure also serves unrelated, legitimate sites.

Closing Assessment

The site should be treated as read-only at most, and only from an isolated environment. No wallet connection, credential entry, asset transfer or payment should occur, and nothing should be downloaded. Anyone who has already interacted with it should review wallet permissions and rotate any exposed credentials.