Is Pages a scam? TrustSniffer's high-risk assessment of modal-api.pages.dev: 5/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a subdomain on a free, shared developer-hosting platform. Automated capture did not reach any native site content. It returned only a brief warning interstitial titled as a suspected-phishing notice, which the platform's protective layer served in place of the site's pages. Because of that, the site's products, services, brand and business model could not be observed. What can be assessed is the hostname, the warning page and the site's behavioural and reputational footprint.

Scam/Impersonation Risk

This is the decisive area. The site is currently blacklisted by multiple independent threat-intelligence sources. Several major security vendors, including established tier-one detection engines, classify it as malicious. A confirmed blacklist hit, together with a prior phishing record for this hostname, produces a hard contradiction. The page served to the analysis crawler was itself a phishing-suspicion warning, which is consistent with those third-party detections. No conflicting legal entities or brand impersonation were identified, so the risk rests on the reputation and phishing signals rather than on identity conflicts. The hostname also closely resembles the generic hosting platform's own domain. Sites on shared subdomains can be created and replaced cheaply, which suits throwaway phishing or malware infrastructure. Runtime behaviour adds some concern without being decisive. During interaction the page made a heavy volume of calls to external destinations, including several outbound data submissions. It also generated repeated script errors and large, rapid page-structure changes. No wallet-connection, clipboard-hijacking, hidden-form or credential-exfiltration behaviour was detected, and all external destinations were recognised ones. Evidence:

• Homepage capture: the page returned was a suspected-phishing interstitial (HTTP 403) rather than site content, with only a minimal amount of text.
• Reputation checks: several security vendors flag the hostname as malicious, and a blacklist control confirmed the listing.
• Domain provenance: the domain is about 1.9 years old, with only 4 archive snapshots from December 2024 to March 2025 (2 years tracked).
• Behavioural sandbox (3 runs): 56 external XHR/fetch requests and 5 external POSTs, up to 96.4% of requests going to external destinations, 17 console errors and 1,508 DOM mutations after interaction.

Regulatory Verification Notes

The captured page carries no legal, licensing, registration or operator-identity disclosures, so no regulatory status can be confirmed. Operator identity could not be independently linked to any real-world person or organisation, and the site's governance is opaque. This is a verification gap, but it is secondary to the reputation findings above and is not treated as a scam indicator on its own. No third-party broker or regulator profile matched this site, so there is no external licensing signal in either direction. The transport-layer encryption is valid, but that only shows that the connection is encrypted. It says nothing about who runs the site or whether it is lawful. Evidence:

• Homepage capture: no company name, licence number, jurisdiction or contact details were present in the content retrieved.
• Third-party broker datasets: no matching entity was found.
• Transport security: a domain-validated TLS certificate issued by WE1, valid to 2026-12-11, with 43 days remaining.

What to Verify Next

Any contact with the site should begin with its origin. Confirm independently who published it and how the link reached the user, because links to throwaway hosted subdomains are a common phishing delivery route. If the site claims to represent an organisation, check through that organisation's official website, typed in directly, or through an offline channel, that it operates this address. Confirm any licence or registration claim in the relevant public registry rather than relying on the site. Re-check the site's reputation after the owner has had time to remediate. This is relevant if the site has been compromised, in which case the listing may later be removed. Evidence:

• Homepage capture: the interstitial gave no legitimate owner, brand or service to verify against.
• Domain history: a young domain with very limited archive history provides no prior track record to rely on.
• Reputation checks: current detections remain active, so any clearing of them would need to be re-checked first.

Summary Verdict

The overall posture is high risk. Multiple independent security sources currently flag the site as malicious, and the available evidence does not offset that reputational finding. The site shows no verifiable operator identity or established track record. Only minor technical hygiene signals, such as a valid certificate and consistent hosting, are present, and these do not change the cautionary conclusion.

Infrastructure Integrity

The site is served through Cloudflare's CDN and web application firewall on AS13335, with all four observed edge IP addresses belonging to Cloudflare and located in the US. The origin server was not observable, so the real hosting location cannot be verified independently. This protective layer is a mitigating factor only. It is shared, low-cost infrastructure that any party can use, and it cannot offset the confirmed external detections.

Closing Assessment

The site should not be used for sign-in, entering credentials or making payments, and nothing should be downloaded from it. Anyone who has already entered credentials or financial details here should change the affected passwords and contact the relevant financial institution. If the site is expected to be legitimate, the intended owner should be notified so it can be reviewed and cleaned.