Is oortech.pages.dev a scam? TrustSniffer's high-risk assessment: 5/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a single-page presentation titled "OORT | Cloud for Decentralized AI Reward is live Now". It is served from a free-tier subdomain of a shared web-publishing platform, not from a dedicated branded domain. The page promotes a decentralized AI cloud and a reward campaign that it says is "live now". Its apparent purpose is to draw visitors into a token-reward or crypto-style engagement flow under the name of an AI infrastructure project.

Scam/Impersonation Risk

The site carries a confirmed blacklist against it, and this is the decisive finding. Multiple independent security engines classify the site as malicious, including several tier-one vendors, and an external blacklist corroborates this. The aggregate detections were strong enough to trigger a hard score ceiling. Nothing offsets this, and the site should be treated as a high-risk destination. A formal phishing flag and a conflicting-legal-identity finding were not recorded, and the page text carries no published contact address to assess. The risk therefore rests on the reputational blacklisting, the platform-subdomain hosting and the behavioural profile. The homepage pairs a "reward is live now" urgency hook with the name of a decentralized AI cloud brand. That is a recognisable lure pattern for reward-claim and wallet-interaction schemes, and nothing independently ties this subdomain to any genuine brand owner. In the behavioural sandbox, the page generated a very heavy volume of outbound background requests, and a large share went to third-party hosts outside the expected set. Several outbound data submissions also went to non-standard destinations. This is atypical for a simple promotional page. The sandbox did not observe wallet-drainer behaviour, clipboard tampering, hidden forms, credential posts to external hosts or cloaking, so the exposure is reputational and traffic-based, not a demonstrated exploit. The brand-like name on a shared-platform subdomain and the flagged reputation together mean any "reward" interaction should be assumed hostile. Evidence:

• Homepage: titled "OORT | Cloud for Decentralized AI Reward is live Now", with an urgency-driven reward claim and no dedicated branded domain.
• Reputation checks: 11 malicious and 1 suspicious detections, including tier-one vendors, plus an external blacklist hit.
• Sandbox: 116 external XHR/fetch calls (30 to non-whitelisted hosts) and 21 external POSTs (6 non-whitelisted), with up to 74.2% of observed traffic going to external hosts. No wallet-drainer, clipboard-hijack, hidden-form or cloaking behaviour was recorded across 3 runs.
• Provenance: the domain is about 2.2 years old, with only 4 archive snapshots spanning 2024-08 to 2024-12 (1 year tracked).

Regulatory Verification Notes

The site presents no evidence of financial, securities or crypto-asset registration. It cites no licensing body, registration number or named legal entity, and it provides no accessible governance disclosure. For a site inviting reward participation, this is a material disclosure gap. On its own it would be a transparency matter, but here it compounds a confirmed reputational blacklisting. No third-party broker or regulatory-database match exists for the site, which is a neutral absence, not an endorsement. The relationship between this page and any real organisation using the OORT name is unestablished, so the content should not be read as an official channel of that project. Technical hygiene is adequate: transport encryption is valid and from a recognised public certificate authority. That is baseline hygiene that scam pages routinely meet, and it is no evidence of legitimacy. Evidence:

• Homepage: no named operating entity, licence reference or registry identifier, and no regulatory statement.
• Transport encryption: TLS certificate issued by WE1 (DV, domain-validated only), valid to 2027-01-01.
• Hosting identity: a subdomain of a shared publishing platform, so the site has no standalone registrant-controlled domain identity.

What to Verify Next

Use of the site should not proceed. The only verification worth performing concerns whether the brand it invokes has any connection to it. The official project's website, social accounts and announcements should be located through an independent route, such as a manually typed address or an established listing. These should be checked for any mention of a reward campaign at this address. Any reward, airdrop or token claim should be treated as unconfirmed until the real project confirms it. Anyone who has already visited and interacted with the page should review wallet approvals and revoke any unfamiliar permissions. Such users should also rotate credentials entered on the page and report the URL to the hosting platform's abuse channel. Evidence:

• Homepage: reward claim "live now" with no verifiable link to an official project announcement.
• Reputation checks: current multi-vendor malicious classification, which is the basis for withholding any interaction.
• Sandbox: third-party POST destinations outside the expected set, which justifies reviewing any data previously submitted.

Summary Verdict

The overall posture is high risk. Strong external threat detections are decisive, and no positive technical or archival signal can counterbalance them. The site's real-world operator and its link to any genuine brand are unestablished. It should be classed as unsuitable for any sensitive or transactional interaction.

Infrastructure Integrity

The site is delivered through Cloudflare, a mainstream CDN/WAF provider, and all four observed addresses are edge nodes. No origin server address was observable, so the underlying host cannot be independently verified. The shared-platform setup and low-TTL, fast-rotating DNS profile also mean content can be changed or swapped quickly without any visible change in infrastructure. Cloudflare's reputation is a mitigating factor only. It speaks to the platform, not to the operator or content, and it does not offset the active threat detections. Evidence:

• Hosting: served from AS13335 (CLOUDFLARENET - Cloudflare, Inc., US), with edge IP 172.66.47.138 among four edge addresses observed.
• DNS: the shared-hosting IP space returned no address attributable to an independent origin.

Closing Assessment

The site should be avoided for any login, credential entry, wallet connection or payment, and nothing should be downloaded from it. Anyone who still needs to look at it should do so only from an isolated environment with no signed-in wallet or accounts.