Is majata-nft.pages.dev safe? TrustSniffer's low-trust assessment: 42/100

Overview

The website presented as "CyberKings – MajataNFT" is an NFT-themed project page published on a free subdomain of a shared web-hosting platform. Its homepage carries a modest amount of text, and its apparent purpose is to promote or sell NFT-related offerings. The captured content gives no reliable detail on the product mechanics, the team behind it, or the commercial terms of any sale or mint.

Scam/Impersonation Risk

This is the decisive factor in the assessment. The site is currently blacklisted by an external blacklist source, based on an external reputation check. At least one engine rates it malicious and others rate it suspicious. This is a confirmed, hard contradiction, and the site's other characteristics do not offset it. No brand impersonation, conflicting legal-entity names, identity inconsistency, or confirmed phishing kit was identified. The listing alone places the site in an elevated-risk category. The setting adds to the concern. NFT sale pages on disposable free-hosted subdomains are a common vehicle for wallet-draining mints and fake-drop schemes, because the operator can be replaced or the content swapped without a trace. This describes a general pattern. It is not a finding that this site operates such a scheme. Behavioural testing found no wallet-connection prompts, wallet-drainer routines, clipboard tampering, hidden forms, or cloaking. That is a mitigating observation, but it comes from a limited set of automated visits and does not clear the listing. The homepage generated a heavy volume of third-party calls and repeated browser errors. These were measured directly in sandbox runs. They are consistent with a loosely assembled template page, so they are discounted as proof of malicious intent. They still widen the data-exposure surface and remain a negative signal. Evidence:

• Homepage: an external reputation check shows the domain on a threat blacklist (1 engine malicious, 2 suspicious). This is a hard signal, and nothing in the captured evidence discounts it.
• Homepage behaviour: 93 external XHR/fetch requests and 12 external POST requests across 3 sandbox runs, with external traffic reaching 35.6% of requests and 9 console errors. 3 requests went to non-whitelisted destinations. These are negative signals, partly discounted because template-style pages often behave this way, but they are not dismissed.
• Homepage behaviour: no wallet-connect, wallet-drainer, clipboard-write, hidden-form, or cloaking activity was observed. This is a mitigating observation, limited to 3 automated runs.
• Domain provenance: ~1.86 years old, with only 4 archive snapshots spanning 2024-12-16 to 2024-12-25 (1 year tracked). This shows a short and thin public history, which is a weak negative signal rather than evidence of wrongdoing.

Regulatory Verification Notes

The captured evidence shows no financial, securities, or digital-asset registration. No regulated-entity record could be matched to the site, and no third-party broker-reputation record exists for it. The operator's real-world identity is unverified (status unknown, low confidence). The AI page analysis was unavailable, so the page was captured but its identity was not AI-verified. The site's name and title are therefore unanchored claims. They cannot be taken as evidence of who runs it. The valid transport-encryption certificate indicates only that the connection to the domain is encrypted. It does not show who controls the domain or whether the offering is lawful. Any NFT sale that promises returns or exclusive access should be treated as unregistered until the operator shows otherwise. Evidence:

• Homepage: the page is titled "CyberKings – MajataNFT" and is served from a shared-platform subdomain, so the domain name does not tie it to any identifiable business.
• Transport security: the TLS certificate was issued by WE1 as a domain-validated (DV) certificate, valid to 2026-12-24 (55 days remaining). DV validation checks domain control only, so this is a neutral technical signal and not an identity signal.
• Hosting: served from AS13335 (CLOUDFLARENET - Cloudflare, Inc., US).

What to Verify Next

Before any interaction, the project's existence and official presence should be confirmed through channels that do not link back to this page. Examples are an established NFT marketplace listing, a verified social account, or a team announcement found independently. The operator's identity and any claimed registration should be checked with the relevant registry or regulator. The blacklist status should be rechecked on the reporting sources, since a recent compromise or clean-up would change the picture. If the site later publishes a mint contract address, it should be checked against the project's independently verified announcements, not the address shown here. Evidence:

• Homepage: the project name and title could not be matched to any verifiable operator in the captured evidence.
• Reputation: the blacklist listing is current, so any delisting or remediation notice should be confirmed with the listing sources.
• Domain history: the very short public record (4 snapshots, 2024-12-16 to 2024-12-25) offers no earlier track record to lean on.

Summary Verdict

The site presents an elevated, clearly cautionary risk posture (low-trust band, score 41.5, classification confidence 0.75). A confirmed external blacklist listing outweighs the technical hygiene signals. The site's identity and legitimacy remain unestablished, and the available evidence is consistent with, but does not prove, a high-risk NFT property. It should be treated as high-risk until the listing is resolved and the operator is independently verified.

Infrastructure Integrity

The site is served entirely through Cloudflare's CDN and WAF. All four observed addresses are Cloudflare edge servers, and the origin server was not observable. Using a well-established provider and holding a valid certificate are mitigating factors only. They indicate that the traffic path is professionally run. They do not establish who operates the content, and they cannot offset the reputation risk. Edge-only visibility also prevents independent hosting verification and makes rapid content swaps harder to detect. Governance and ownership details are likewise not visible.

Closing Assessment

The site should be treated as read-only at most. Wallet connections, credential entry, mint or purchase payments, and any approval of token permissions should be avoided. Anyone who has already interacted with it should review and revoke wallet permissions and check for unauthorised transactions.