Is moonedge-earn.pages.dev a scam? TrustSniffer's high-risk assessment: 5/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This site is a project hosted as a subdomain on a shared, free developer hosting platform, and its name ("moonedge-earn") suggests a yield or "earn" style crypto-finance offering. The page captured for a visitor was not a product page. It was a platform interstitial titled as a suspected-phishing warning, so the site's actual offering and business model could not be confirmed from its own content.

Scam/Impersonation Risk

This is the decisive area of the assessment. Several leading security vendors currently flag the site as malicious, and the aggregate count of detections is high enough to constitute a confirmed blacklisting. Separately, the hosting platform's own interstitial labels the site as suspected phishing. The domain also closely resembles the shared hosting platform's own domain, which is a lookalike pattern commonly used to borrow credibility for deceptive pages. Sandboxed runs found no wallet-drainer behaviour, clipboard manipulation, hidden forms or credential posts to external hosts. Those negatives do not offset the external detections, because the visible page was a warning screen and not the content a victim would eventually be shown. The sandbox did record heavy outbound activity: a very large share of requests went to third-party hosts, including dozens of cross-origin data calls and several outbound POST requests. Page structure also changed sharply after interaction, and the console logged repeated errors. That combination is consistent with a script-heavy front end that loads content dynamically, which is typical of "earn" or staking lures that reveal their real mechanics only after a visitor engages. The site shows no identity contradiction, because no legal-entity names were available to conflict. Evidence:

• Homepage: the captured page was a hosting-platform warning interstitial returned with an access-denied status, titled as a suspected phishing site.
• Reputation: 17 security engines flagged the domain as malicious, including three tier-1 vendors, and an external blacklist hit is confirmed.
• Domain provenance: first seen in 2024, about 1.9 years old, with 9 archive snapshots spanning December 2024 to April 2025 (2 years tracked).
• Sandbox behaviour: 52 cross-origin data calls, 4 external POST requests, 16 console errors and about 1,500 DOM mutations after interaction, across 3 successful runs.

Regulatory Verification Notes

No regulatory standing can be attributed to the operator. No licence, registration or corporate identity was found, and no third-party broker or regulator record matched the site. Because the only page captured was the platform's warning screen, no terms, privacy, about or legal page from the operator could be reviewed. The domain sits under a shared hosting platform's namespace, so it carries no independently registered corporate identity of its own. Any claim that the site is licensed to take deposits or offer yield products would therefore be entirely unsubstantiated. This verification gap is secondary to the reputational findings above and is not the basis of the cautionary rating. Evidence:

• Homepage: only the platform interstitial was served, so no operator legal text was available to assess.
• Hosting: served from AS13335 (Cloudflare, Inc., US) under the ARIN registry.
• Transport encryption: a domain-validated TLS certificate issued by WE1, valid to 2026-12-13, which confirms an encrypted connection and nothing about who runs the site.

What to Verify Next

Any contact with this site should be preceded by independent confirmation of whether a real product exists. The first step is to identify the claimed operator through an official, independently sourced channel, such as a brand's verified social profile or a registry entry, and not through links reached from this domain. Any asserted licence or financial-services registration should be checked directly with the relevant regulator's public register. The platform's phishing warning and the vendor detections should be treated as a standing block until the site is demonstrably cleared. Anyone who has already visited and connected a wallet or entered details should review their wallet approvals and rotate credentials. Evidence:

• Homepage: the platform warning, not a product page, is what a visitor currently receives.
• Reputation: the confirmed external detections remain active and are not attributable to a single vendor.
• Domain history: the domain is under two years old, with a short archive record and no established public footprint to corroborate a legitimate operator.

Summary Verdict

The assessment is critical and clearly cautionary. Confirmed multi-vendor malicious detections combined with the host platform's own phishing warning outweigh every neutral or positive technical attribute. The site's legitimacy is unsupported, and its real-world operator remains unidentified. The overall posture is high risk for any sensitive interaction.

Infrastructure Integrity

The site is fronted by a major CDN and web application firewall, and all observed addresses are edge nodes, so the origin server is not visible. A valid certificate and a recognised network provider are mitigating technical hygiene factors only. They cannot offset the reputational findings, since such infrastructure is freely available to malicious and benign sites alike. Edge-only visibility also prevents independent verification of where the content is actually served from.

Closing Assessment

The site should be avoided for anything beyond passive viewing. No credentials, personal data, funds or wallet connections should be provided to it, and it should be reported to the hosting platform if it was reached through an unsolicited message or advertisement.