---
title: "Is modal-api.pages.dev a Scam? Trust Score 5/100"
source: TrustSniffer
type: Website trust & fraud report
subject: "modal-api.pages.dev"
verdict: "Critical Risk"
title: "Is Pages a scam? modal-api.pages.dev trust score 5/100"
trust_score: 5
classification_confidence: 70
canonical_url: https://trustsniffer.com/report/modal-api.pages.dev
assessed: 2026-10-29
---

# Is Pages a scam? TrustSniffer's high-risk assessment of modal-api.pages.dev: 5/100

## Verdict


**Verdict: Critical Risk, trust score 5/100.** modal-api.pages.dev shows high-risk / scam indicators.

This assessment found strong scam indicators. Do not pay, sign in, or share personal details with this site.

Labels: Sensitive Interaction Risk, Governance Risk

Assessed 2026-10-29 by automated analysis. Classification confidence 70%.

## Evidence status and limitations


Evidence completeness: Not recorded

- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.

## At a glance

The checks that decide most of this verdict.

| Check | Result | Status |
| --- | --- | --- |
| Malware engines | 11 flagged it (VirusTotal) | Risk |
| Google Safe Browsing | Not listed (Google) | Clear |
| Abuse reports on the host | 0% confidence (AbuseIPDB, 0 reports; shared hosting inflates reports) | Clear |
| Domain age | 1.9 years old (Registered history) | Clear |
| Web archive | Archived since 2024 (4 snapshots) | Clear |
| Certificate | Encrypted connection (Issued by WE1) | Noted |

## The page as captured


![Screenshot of the modal-api.pages.dev homepage captured during the TrustSniffer assessment](https://trustsniffer.com/outputs/modal-api.pages.dev/screenshots/first.png)

_What modal-api.pages.dev served when TrustSniffer captured it on 2026-10-29. The page may look different now._

## Key findings


- Automated classification: Sensitive Interaction Risk.
- Domain age: 1 to 3 years (registration continuity).
- Public web-archive history exists since 2024.
- At least one reputation service TrustSniffer consulted had flagged this domain at assessment time.

## Full analysis


### Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a subdomain on a free, shared developer-hosting platform. Automated capture did not reach any native site content. It returned only a brief warning interstitial titled as a suspected-phishing notice, which the platform's protective layer served in place of the site's pages. Because of that, the site's products, services, brand and business model could not be observed. What can be assessed is the hostname, the warning page and the site's behavioural and reputational footprint.


### Scam/Impersonation Risk

This is the decisive area. The site is **currently blacklisted** by multiple independent threat-intelligence sources. Several major security vendors, including established tier-one detection engines, classify it as malicious. A confirmed blacklist hit, together with a prior phishing record for this hostname, produces a hard contradiction. The page served to the analysis crawler was itself a phishing-suspicion warning, which is consistent with those third-party detections. No conflicting legal entities or brand impersonation were identified, so the risk rests on the reputation and phishing signals rather than on identity conflicts. The hostname also closely resembles the generic hosting platform's own domain. Sites on shared subdomains can be created and replaced cheaply, which suits throwaway phishing or malware infrastructure. Runtime behaviour adds some concern without being decisive. During interaction the page made a heavy volume of calls to external destinations, including several outbound data submissions. It also generated repeated script errors and large, rapid page-structure changes. No wallet-connection, clipboard-hijacking, hidden-form or credential-exfiltration behaviour was detected, and all external destinations were recognised ones. Evidence:

- Homepage capture: the page returned was a suspected-phishing interstitial (HTTP 403) rather than site content, with only a minimal amount of text.
- Reputation checks: several security vendors flag the hostname as malicious, and a blacklist control confirmed the listing.
- Domain provenance: the domain is about 1.9 years old, with only 4 archive snapshots from December 2024 to March 2025 (2 years tracked).
- Behavioural sandbox (3 runs): 56 external XHR/fetch requests and 5 external POSTs, up to 96.4% of requests going to external destinations, 17 console errors and 1,508 DOM mutations after interaction.

### Regulatory Verification Notes

The captured page carries no legal, licensing, registration or operator-identity disclosures, so no regulatory status can be confirmed. Operator identity could not be independently linked to any real-world person or organisation, and the site's governance is opaque. This is a verification gap, but it is secondary to the reputation findings above and is not treated as a scam indicator on its own. No third-party broker or regulator profile matched this site, so there is no external licensing signal in either direction. The transport-layer encryption is valid, but that only shows that the connection is encrypted. It says nothing about who runs the site or whether it is lawful. Evidence:

- Homepage capture: no company name, licence number, jurisdiction or contact details were present in the content retrieved.
- Third-party broker datasets: no matching entity was found.
- Transport security: a domain-validated TLS certificate issued by WE1, valid to 2026-12-11, with 43 days remaining.

### What to Verify Next

Any contact with the site should begin with its origin. Confirm independently who published it and how the link reached the user, because links to throwaway hosted subdomains are a common phishing delivery route. If the site claims to represent an organisation, check through that organisation's official website, typed in directly, or through an offline channel, that it operates this address. Confirm any licence or registration claim in the relevant public registry rather than relying on the site. Re-check the site's reputation after the owner has had time to remediate. This is relevant if the site has been compromised, in which case the listing may later be removed. Evidence:

- Homepage capture: the interstitial gave no legitimate owner, brand or service to verify against.
- Domain history: a young domain with very limited archive history provides no prior track record to rely on.
- Reputation checks: current detections remain active, so any clearing of them would need to be re-checked first.

### Summary Verdict

The overall posture is high risk. Multiple independent security sources currently flag the site as malicious, and the available evidence does not offset that reputational finding. The site shows no verifiable operator identity or established track record. Only minor technical hygiene signals, such as a valid certificate and consistent hosting, are present, and these do not change the cautionary conclusion.


### Infrastructure Integrity

The site is served through Cloudflare's CDN and web application firewall on AS13335, with all four observed edge IP addresses belonging to Cloudflare and located in the US. The origin server was not observable, so the real hosting location cannot be verified independently. This protective layer is a mitigating factor only. It is shared, low-cost infrastructure that any party can use, and it cannot offset the confirmed external detections.


### Closing Assessment

The site should not be used for sign-in, entering credentials or making payments, and nothing should be downloaded from it. Anyone who has already entered credentials or financial details here should change the affected passwords and contact the relevant financial institution. If the site is expected to be legitimate, the intended owner should be notified so it can be reviewed and cleaned.


_Written analysis generated 2026-10-29 by the TrustSniffer Analysis Engine from the evidence in this report._

## What the analysis found

3 findings contributed to this verdict, raised by external reputation, behaviour in a sandbox, registration and ownership.

### 01 External reputation
- An external threat feed lists this domain: either Google Safe Browsing marked it malicious, or a significant number of malware engines flagged it. (External reputation `rule:EXT_BLACKLIST_CRITICAL`)

### 02 Behaviour in a sandbox
- Most of what the page loaded came from other domains rather than from this one. (Behaviour in a sandbox `rule:BEHAV_EXTERNAL_RATIO_HIGH`)
- The structure of the page changed sharply while it was loading. (Behaviour in a sandbox `rule:BEHAV_DOM_DENSITY_SPIKE`)
- The page produced an unusually high number of errors while it ran. (Behaviour in a sandbox `rule:BEHAV_CONSOLE_ERRORS_HIGH`)
- The page made many background requests to other domains while it was open. (Behaviour in a sandbox `rule:BEHAV_EXTERNAL_XHR_HEAVY`)

### 03 Registration and ownership
- The public registration record for this domain is incomplete. (Registration and ownership `rule:KF_WHOIS_INCOMPLETE`)

## Identity verification


| Field | Value |
| --- | --- |
| Status | UNKNOWN |
| Identity score | 50/100 |
| Identity verification confidence | 30% |

- AI page analysis unavailable (page captured; identity not AI-verified)

_Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence._

## What TrustSniffer observed

First-party facts recorded during the assessment of modal-api.pages.dev.

- The request stayed on modal-api.pages.dev. It was not redirected to another domain. (Clear)
- The earliest public archive of this site is from 2024-12-02. (Clear)
- It is hosted on CLOUDFLARENET, from a server in US. (Noted)

## Domain intelligence


| Field | Value |
| --- | --- |
| Registrar | Not available |
| Hosting | CLOUDFLARENET - Cloudflare, Inc., US |
| Country | US |
| Server IP | 2606:4700:310c::ac42:2c8d |
| Name servers | Not available |
| CDN / edge network | Detected (cloudflare) |
| Resolved IP addresses | 4 |
| Edge IP addresses | 4 |
| Likely origin IP addresses | 0 |
| SSL issuer | WE1 |
| SSL expiry | 2026-12-11 |
| Domain age | 1.91 years (continuous registration) |
| Domain expiry | Not available |
| Archive first seen | 2024-12-02 |
| Archive snapshots | 4 |
| Reputation | VirusTotal: 11 flagged \| AbuseIPDB: 0% confidence, 0 reports \| Google Safe Browsing: 0 matches |

## About this assessment


**Was this report useful?** Tell other people what you think of TrustSniffer, good or bad. An honest review helps others decide whether to rely on these checks. [Review TrustSniffer on Trustpilot](https://www.trustpilot.com/review/trustsniffer.com)

A trust score summarises the evidence TrustSniffer could collect about modal-api.pages.dev at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.

TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.

## Related on TrustSniffer
- [pufferfi-e9t.pages.dev](https://trustsniffer.com/report/pufferfi-e9t.pages.dev), a similar name (Critical Risk, 5/100)
- [webauthdashboard-c8x.pages.dev](https://trustsniffer.com/report/webauthdashboard-c8x.pages.dev), a similar name (Critical Risk, 0/100)
- [billcipherwld.pages.dev](https://trustsniffer.com/report/billcipherwld.pages.dev), a similar name (Critical Risk, 0/100)
- [netnetaneta4558.pages.dev](https://trustsniffer.com/report/netnetaneta4558.pages.dev), a similar name (Critical Risk, 14/100)
- [bulldogito-com.pages.dev](https://trustsniffer.com/report/bulldogito-com.pages.dev), a similar name (Critical Risk, 5/100)
- [xend-brige.pages.dev](https://trustsniffer.com/report/xend-brige.pages.dev), a similar name (Critical Risk, 5/100)
- [43fffeeww2.pages.dev](https://trustsniffer.com/report/43fffeeww2.pages.dev), a similar name (Critical Risk, 0/100)
- [minted-genesisrunescom.pages.dev](https://trustsniffer.com/report/minted-genesisrunescom.pages.dev), a similar name (Critical Risk, 0/100)
- [portal-moonshot-lv3.netlify.app](https://trustsniffer.com/report/portal-moonshot-lv3.netlify.app), another site assessed as critical-risk (Critical Risk, 0/100)
- [publications.best](https://trustsniffer.com/report/publications.best), another site assessed as critical-risk (Critical Risk, 15/100)
- [Every website and wallet TrustSniffer has assessed](https://trustsniffer.com/directory), the full risk directory
- [Other domains assessed as high-risk or phishing](https://trustsniffer.com/directory/phishing-domains), same verdict band
- [Check another website](https://trustsniffer.com/web-intelligence), run a new assessment
- [Check a crypto wallet address](https://trustsniffer.com/on-chain-risk), on-chain screening
- [The TrustSniffer Risk Index](https://trustsniffer.com/stats), how this verdict compares

## Guides
- [Stablecoin Freezes, Oct 27, 2026: 7 Wallets](https://trustsniffer.com/blog/stablecoin-freeze-report-2026-10-27)
- [No Age Distribution Yet for Suspicious Websites](https://trustsniffer.com/blog/no-age-distribution-suspicious-websites)
- [How to revoke token approval after a scam site](https://trustsniffer.com/blog/how-to-revoke-token-approval-after-a-scam-site)

---
*Source: [TrustSniffer](https://trustsniffer.com/report/modal-api.pages.dev) — independent automated trust & fraud analysis. Cite as https://trustsniffer.com/report/modal-api.pages.dev · assessed 2026-10-29.*