Is merlin-68m.pages.dev a scam? TrustSniffer's high-risk assessment: 5/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

MerlinStarter is a single-page website published as a subdomain on a shared, free web-hosting platform. Its homepage carries the title "MerlinStarter" and a short block of text, with no named operator, product catalogue, or contact details visible to a visitor. Its apparent purpose is to present a starter or launch-style project, but the content captured is too thin to establish a concrete business model.

Scam/Impersonation Risk

The site is blacklisted. Multiple independent threat-intelligence engines currently flag it as malicious, including several tier-one security vendors, and an external blacklist hit is confirmed. This is the decisive finding and outweighs every neutral or favourable technical signal. No conflicting legal identities and no impersonation of a specific brand were observed, so the concern comes from reputation and detection history rather than from contradictory identity claims. The domain also closely resembles the name of its host platform, which is a common pattern for disposable or throwaway deployments. Behavioural testing did not catch wallet-connection prompts, clipboard manipulation, hidden forms, or password submission to external parties. That is a limited mitigating observation, because the page was only briefly exercised and flagged detections can relate to content served at other times. The site's page loads a heavy volume of third-party requests, with over half of its network activity directed to external hosts. That is atypical for a page this small and weakens confidence in what the page actually delivers. Evidence:

• Homepage: more than a dozen security engines classify the site as malicious, and one more marks it suspicious. Three of them are leading vendors.
• Homepage: behavioural runs recorded 74 external requests, none to unknown or non-allow-listed destinations, and no external POST submissions.
• Homepage: the page content is only about two thousand characters, with no company name, product detail, or contact artifact.
• Domain provenance: the domain is about 2.1 years old (registered around 2024), and the web archive holds 10 snapshots spanning 2024–2025 (2 years tracked).

Regulatory Verification Notes

The captured homepage identifies no operating company, no licence or registration number, and no legal or terms pages, so there is nothing on the site against which to check regulatory status. No third-party broker or regulator record matches the site. The absence of a match is not a regulatory finding either way. The site's identity could not be independently connected to a real-world person or organisation. The site's own content gives no basis for treating it as a regulated or accountable entity. A valid certificate and recognised hosting are routine properties of the platform and do not substitute for accountability. Evidence:

• Homepage: no operator name, licence reference, or registration number is shown.
• Hosting: served from AS13335 (Cloudflare, US).
• Transport encryption: TLS certificate issued by WE1 (domain-validated only), valid to 2027-01-14.

What to Verify Next

Any dealings should be preceded by independent confirmation that a real organisation stands behind this project, using channels found outside the site itself. This includes searching the relevant company and financial-services registries for the project's claimed operator. The project's official domain should also be confirmed through an independent, known-good source, since this address sits on a shared hosting subdomain and could be a copy or a staging deployment. Official support channels should be confirmed the same way. The current detections should be rechecked against live reputation sources before any decision, because the flagged state may change if the owner remediates. Evidence:

• Homepage: no operator or contact details are given to cross-check, so verification must start from an external source.
• Hosting platform: the site runs on a shared platform subdomain rather than a standalone, independently registered domain.
• Reputation: the active detections are the principal open item to recheck.

Summary Verdict

The overall posture is high-risk. Confirmed blacklist-level detections from multiple reputable security sources dominate the assessment, and nothing else in the evidence offsets them. Identity is unverified, and the site cannot be treated as a trustworthy counterparty.

Infrastructure Integrity

The site is delivered through Cloudflare's CDN and WAF, and all observed addresses are edge servers, with the origin not visible. This is protective infrastructure and a mitigating factor only. It supports availability and transport security, but it also prevents independent verification of the true hosting and can mask rapid content changes. It cannot offset the active threat detections.

Closing Assessment

The site should not be used for login, credential entry, wallet interaction, or any financial transaction. Any visit should be limited to read-only viewing from an isolated, non-sensitive environment, and nothing should be downloaded from it.