Is node-mainnetsynch.pages.dev a scam? TrustSniffer's high-risk assessment: 5/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a page served from a free, shared Cloudflare Pages subdomain. The name suggests a blockchain mainnet node-synchronization utility. The only content captured from the homepage was a platform interstitial titled "Suspected Phishing", returned with an access-denied status, so the site's own product, branding and business model could not be read. The domain's apparent purpose is therefore unclear. A name styled as a node or network-sync tool, on a disposable subdomain, matches the pattern phishing kits use to lure crypto users into connecting wallets or entering recovery phrases. The evidence does not show what, if anything, the site actually asks visitors to do.

Scam/Impersonation Risk

This assessment is clearly cautionary. The site has confirmed blacklist exposure from multiple independent threat-intelligence sources. Several leading security vendors independently classify it as malicious, which triggered an automatic hard cap on the assessment. Separately, the homepage capture itself was a Cloudflare phishing-warning interstitial, so the hosting platform's own defences have also flagged the page. This is the decisive issue. Technical hygiene elsewhere cannot offset it. No conflicting legal identities were found, and no specific brand impersonation was established from page content, because that content was never captured. The risk therefore rests on the reputation and blacklist signals and not on a named lookalike. The sandbox run saw no wallet-connection prompts, no wallet-drainer behaviour, no clipboard manipulation and no hidden or externally posting credential forms. Those findings come from a session that mostly met a challenge page. They show only that nothing harmful was observed in that session, not that the destination is safe. Other behavioural anomalies were consistent with an unstable or script-heavy page. Nearly all outbound browser requests went to third-party hosts, there was a large burst of page changes after interaction, and the page logged a high number of script errors. Evidence:

• Homepage: the capture returned a Cloudflare interstitial titled "Suspected Phishing" with an access-denied (403) response, and only a very short body of text.
• Reputation: multiple major security vendors flag the domain as malicious, and the external blacklist check is positive.
• Behavioural sandbox (three successful runs): no wallet-connect, drainer, clipboard-hijack or hidden-form activity. Third-party requests made up about 97% of outbound browser traffic.
• Provenance: domain registered in 2024 (~2.2 years old). The web archive holds only 6 snapshots, spanning 2024-08 to 2024-12 (1 year tracked).

Regulatory Verification Notes

No regulator, licence or registration status could be tied to this site. No third-party broker or financial-services record matched it. Because the page content was not captured, the site's own legal, terms and about pages could not be assessed for company names or licence numbers. The operator is also not identified in the evidence reviewed, and the free shared subdomain gives no registrant-level attribution, so ownership opacity applies. That is an administrative limitation and not an identity contradiction. The absence of regulatory standing is not evidence of wrongdoing by itself. In this case, though, it sits beside confirmed blacklist exposure and gives no mitigating credibility. Evidence:

• Hosting: served from AS13335 (Cloudflare, Inc., US).
• Transport encryption: TLS certificate issued by WE1 (domain-validated, DV), valid to 2026-12-26. A domain-validated certificate confirms only control of the domain, not the operator's identity.
• Third-party records: no broker or regulatory-database match for the domain.

What to Verify Next

No one should interact with this domain until the blacklist status is resolved. A visitor who arrived via a message, advert or social post should confirm independently with the blockchain project or service concerned whether it runs any node-synchronization tool at this address, using the project's official website or documentation reached by a separate route. The advertising message itself must not be used as the source. Anyone who has already connected a wallet, entered a recovery phrase or typed credentials on this domain should treat those assets and accounts as exposed. They should revoke token approvals, move funds to a fresh wallet and change reused passwords. A party that claims to own the site should supply verifiable operator details and submit the domain for re-review only after the content has been audited. Evidence:

• Homepage: the platform-level phishing warning means the page may have been reported by users or flagged automatically.
• Reputation: the confirmed blacklist exposure means any official project link would have to be established from outside this domain.
• Contact channels: any official support or contact channels should be confirmed through an independent route.

Summary Verdict

The overall posture is critical and high risk. Decisive external threat detections, together with the platform's own phishing warning, dominate the assessment. Identity and operator are unverified, and nothing in the evidence offers credible legitimacy that could outweigh these findings.

Infrastructure Integrity

The domain resolves entirely to Cloudflare edge addresses. The site sits behind Cloudflare's CDN and WAF with bot-challenge protection, and no origin server address was visible. Edge-only visibility prevents independent hosting verification. It also means the origin could be swapped without any visible change. This protective layer is a minor mitigating factor only. It is shared, commodity infrastructure available to any account, and it does not offset the reputation findings.

Closing Assessment

The site should be treated as unsafe for any sign-in, credential entry, wallet connection, payment or file download. Even passive browsing is best avoided, and any link that points here should be reported and not followed.