--- title: "Is node-mainnetsynch.pages.dev a Scam? Trust Score 5/100" source: TrustSniffer type: Website trust & fraud report subject: "node-mainnetsynch.pages.dev" verdict: "Critical Risk" title: "Is node-mainnetsynch.pages.dev a Scam? Trust Review, 5/100" trust_score: 5 classification_confidence: 75 canonical_url: https://trustsniffer.com/report/node-mainnetsynch.pages.dev assessed: 2026-10-29 --- # Is node-mainnetsynch.pages.dev a scam? TrustSniffer's high-risk assessment: 5/100 ## Verdict **Verdict: Critical Risk, trust score 5/100.** node-mainnetsynch.pages.dev shows high-risk / scam indicators. This assessment found strong scam indicators. Do not pay, sign in, or share personal details with this site. Labels: Sensitive Interaction Risk, Governance Risk Assessed 2026-10-29 by automated analysis. Classification confidence 75%. ## Evidence status and limitations Evidence completeness: Not recorded - The real-world operator identity was not independently verified. - Module-level completeness metadata is unavailable for this legacy report. ## At a glance The checks that decide most of this verdict. | Check | Result | Status | | --- | --- | --- | | Malware engines | 11 flagged it (VirusTotal) | Risk | | Google Safe Browsing | Not listed (Google) | Clear | | Abuse reports on the host | 0% confidence (AbuseIPDB, 0 reports; shared hosting inflates reports) | Clear | | Domain age | 2.2 years old (Registered history) | Clear | | Web archive | Archived since 2024 (6 snapshots) | Clear | | Certificate | Encrypted connection (Issued by WE1) | Noted | ## The page as captured ![Screenshot of the node-mainnetsynch.pages.dev homepage captured during the TrustSniffer assessment](https://trustsniffer.com/outputs/node-mainnetsynch.pages.dev/screenshots/first.png) _What node-mainnetsynch.pages.dev served when TrustSniffer captured it on 2026-10-29. The page may look different now._ ## Key findings - Automated classification: Sensitive Interaction Risk. - Domain age: 1 to 3 years (registration continuity). - Public web-archive history exists since 2024. - At least one reputation service TrustSniffer consulted had flagged this domain at assessment time. ## Full analysis ### Security Alert Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution. This website is a page served from a free, shared Cloudflare Pages subdomain. The name suggests a blockchain mainnet node-synchronization utility. The only content captured from the homepage was a platform interstitial titled "Suspected Phishing", returned with an access-denied status, so the site's own product, branding and business model could not be read. The domain's apparent purpose is therefore unclear. A name styled as a node or network-sync tool, on a disposable subdomain, matches the pattern phishing kits use to lure crypto users into connecting wallets or entering recovery phrases. The evidence does not show what, if anything, the site actually asks visitors to do. ### Scam/Impersonation Risk This assessment is clearly cautionary. The site has **confirmed blacklist exposure** from multiple independent threat-intelligence sources. Several leading security vendors independently classify it as malicious, which triggered an automatic hard cap on the assessment. Separately, the homepage capture itself was a Cloudflare phishing-warning interstitial, so the hosting platform's own defences have also flagged the page. This is the decisive issue. Technical hygiene elsewhere cannot offset it. No conflicting legal identities were found, and no specific brand impersonation was established from page content, because that content was never captured. The risk therefore rests on the reputation and blacklist signals and not on a named lookalike. The sandbox run saw no wallet-connection prompts, no wallet-drainer behaviour, no clipboard manipulation and no hidden or externally posting credential forms. Those findings come from a session that mostly met a challenge page. They show only that nothing harmful was observed in that session, not that the destination is safe. Other behavioural anomalies were consistent with an unstable or script-heavy page. Nearly all outbound browser requests went to third-party hosts, there was a large burst of page changes after interaction, and the page logged a high number of script errors. Evidence: - Homepage: the capture returned a Cloudflare interstitial titled "Suspected Phishing" with an access-denied (403) response, and only a very short body of text. - Reputation: multiple major security vendors flag the domain as malicious, and the external blacklist check is positive. - Behavioural sandbox (three successful runs): no wallet-connect, drainer, clipboard-hijack or hidden-form activity. Third-party requests made up about 97% of outbound browser traffic. - Provenance: domain registered in 2024 (~2.2 years old). The web archive holds only 6 snapshots, spanning 2024-08 to 2024-12 (1 year tracked). ### Regulatory Verification Notes No regulator, licence or registration status could be tied to this site. No third-party broker or financial-services record matched it. Because the page content was not captured, the site's own legal, terms and about pages could not be assessed for company names or licence numbers. The operator is also not identified in the evidence reviewed, and the free shared subdomain gives no registrant-level attribution, so **ownership opacity** applies. That is an administrative limitation and not an identity contradiction. The absence of regulatory standing is not evidence of wrongdoing by itself. In this case, though, it sits beside confirmed blacklist exposure and gives no mitigating credibility. Evidence: - Hosting: served from AS13335 (Cloudflare, Inc., US). - Transport encryption: TLS certificate issued by WE1 (domain-validated, DV), valid to 2026-12-26. A domain-validated certificate confirms only control of the domain, not the operator's identity. - Third-party records: no broker or regulatory-database match for the domain. ### What to Verify Next No one should interact with this domain until the blacklist status is resolved. A visitor who arrived via a message, advert or social post should confirm independently with the blockchain project or service concerned whether it runs any node-synchronization tool at this address, using the project's official website or documentation reached by a separate route. The advertising message itself must not be used as the source. Anyone who has already connected a wallet, entered a recovery phrase or typed credentials on this domain should treat those assets and accounts as exposed. They should revoke token approvals, move funds to a fresh wallet and change reused passwords. A party that claims to own the site should supply verifiable operator details and submit the domain for re-review only after the content has been audited. Evidence: - Homepage: the platform-level phishing warning means the page may have been reported by users or flagged automatically. - Reputation: the confirmed blacklist exposure means any official project link would have to be established from outside this domain. - Contact channels: any official support or contact channels should be confirmed through an independent route. ### Summary Verdict The overall posture is **critical and high risk**. Decisive external threat detections, together with the platform's own phishing warning, dominate the assessment. Identity and operator are unverified, and nothing in the evidence offers credible legitimacy that could outweigh these findings. ### Infrastructure Integrity The domain resolves entirely to Cloudflare edge addresses. The site sits behind Cloudflare's CDN and WAF with bot-challenge protection, and no origin server address was visible. Edge-only visibility prevents independent hosting verification. It also means the origin could be swapped without any visible change. This protective layer is a minor mitigating factor only. It is shared, commodity infrastructure available to any account, and it does not offset the reputation findings. ### Closing Assessment The site should be treated as unsafe for any sign-in, credential entry, wallet connection, payment or file download. Even passive browsing is best avoided, and any link that points here should be reported and not followed. _Written analysis generated 2026-10-29 by the TrustSniffer Analysis Engine from the evidence in this report._ ## What the analysis found 4 findings contributed to this verdict, raised by governance, external reputation, behaviour in a sandbox, registration and ownership. ### 01 Governance - A threat feed lists this domain as malicious, and that caps the score whatever the other checks found. (Governance `rule:GOV_CRITICAL_BLACKLIST`) ### 02 External reputation - An external threat feed lists this domain: either Google Safe Browsing marked it malicious, or a significant number of malware engines flagged it. (External reputation `rule:EXT_BLACKLIST_CRITICAL`) ### 03 Behaviour in a sandbox - Most of what the page loaded came from other domains rather than from this one. (Behaviour in a sandbox `rule:BEHAV_EXTERNAL_RATIO_HIGH`) - The structure of the page changed sharply while it was loading. (Behaviour in a sandbox `rule:BEHAV_DOM_DENSITY_SPIKE`) - The page produced an unusually high number of errors while it ran. (Behaviour in a sandbox `rule:BEHAV_CONSOLE_ERRORS_HIGH`) ### 04 Registration and ownership - The public registration record for this domain is incomplete. (Registration and ownership `rule:KF_WHOIS_INCOMPLETE`) ## Identity verification | Field | Value | | --- | --- | | Status | UNKNOWN | | Identity score | 50/100 | | Identity verification confidence | 30% | - AI page analysis unavailable (page captured; identity not AI-verified) _Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence._ ## What TrustSniffer observed First-party facts recorded during the assessment of node-mainnetsynch.pages.dev. - The request stayed on node-mainnetsynch.pages.dev. It was not redirected to another domain. (Clear) - The earliest public archive of this site is from 2024-08-20. (Clear) - It is hosted on CLOUDFLARENET, from a server in US. (Noted) ## Domain intelligence | Field | Value | | --- | --- | | Registrar | Not available | | Hosting | CLOUDFLARENET - Cloudflare, Inc., US | | Country | US | | Server IP | 2606:4700:310c::ac42:2c51 | | Name servers | Not available | | CDN / edge network | Detected (cloudflare) | | Resolved IP addresses | 4 | | Edge IP addresses | 4 | | Likely origin IP addresses | 0 | | SSL issuer | WE1 | | SSL expiry | 2026-12-26 | | Domain age | 2.19 years (continuous registration) | | Domain expiry | Not available | | Archive first seen | 2024-08-20 | | Archive snapshots | 6 | | Reputation | VirusTotal: 11 flagged \| AbuseIPDB: 0% confidence, 0 reports \| Google Safe Browsing: 0 matches | ## About this assessment **Was this report useful?** Tell other people what you think of TrustSniffer, good or bad. An honest review helps others decide whether to rely on these checks. [Review TrustSniffer on Trustpilot](https://www.trustpilot.com/review/trustsniffer.com) A trust score summarises the evidence TrustSniffer could collect about node-mainnetsynch.pages.dev at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present. TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed. ## Related on TrustSniffer - [blockdagtoken.pages.dev](https://trustsniffer.com/report/blockdagtoken.pages.dev), a similar name (Critical Risk, 5/100) - [telcoins-bank-net.pages.dev](https://trustsniffer.com/report/telcoins-bank-net.pages.dev), a similar name (Critical Risk, 0/100) - [yeifi-votings.pages.dev](https://trustsniffer.com/report/yeifi-votings.pages.dev), a similar name (Critical Risk, 20/100) - [mindnetwork-xyz.pages.dev](https://trustsniffer.com/report/mindnetwork-xyz.pages.dev), a similar name (Critical Risk, 0/100) - [orai-ae.pages.dev](https://trustsniffer.com/report/orai-ae.pages.dev), a similar name (Critical Risk, 5/100) - [tronscanerc.pages.dev](https://trustsniffer.com/report/tronscanerc.pages.dev), a similar name (Critical Risk, 5/100) - [blockdagpresales.pages.dev](https://trustsniffer.com/report/blockdagpresales.pages.dev), a similar name (Critical Risk, 5/100) - [rewards-paal-ai-io.pages.dev](https://trustsniffer.com/report/rewards-paal-ai-io.pages.dev), a similar name (Critical Risk, 5/100) - [blockswalletschain.web.app](https://trustsniffer.com/report/blockswalletschain.web.app), another site assessed as critical-risk (Critical Risk, 0/100) - [vote-xaman.org](https://trustsniffer.com/report/vote-xaman.org), another site assessed as critical-risk (Critical Risk, 0/100) - [Every website and wallet TrustSniffer has assessed](https://trustsniffer.com/directory), the full risk directory - [Other domains assessed as high-risk or phishing](https://trustsniffer.com/directory/phishing-domains), same verdict band - [Check another website](https://trustsniffer.com/web-intelligence), run a new assessment - [Check a crypto wallet address](https://trustsniffer.com/on-chain-risk), on-chain screening - [The TrustSniffer Risk Index](https://trustsniffer.com/stats), how this verdict compares ## Guides - [Connect a Wallet to a Scam Site: What Happens](https://trustsniffer.com/blog/connect-wallet-to-a-scam-site-what-happens) - [Stablecoin Freezes, Oct 24, 2026: 15 Wallets](https://trustsniffer.com/blog/stablecoin-freeze-report-2026-10-24) - [Stablecoin Freezes, Oct 30, 2026: 72 Wallets](https://trustsniffer.com/blog/stablecoin-freeze-report-2026-10-30) --- *Source: [TrustSniffer](https://trustsniffer.com/report/node-mainnetsynch.pages.dev) — independent automated trust & fraud analysis. Cite as https://trustsniffer.com/report/node-mainnetsynch.pages.dev · assessed 2026-10-29.*