Verdict
This assessment found strong scam indicators. Do not pay, sign in, or share personal details with this site.
pi-theta-five.vercel.app shows high-risk / scam indicators.
Evidence status and limitations
Evidence completeness: Not recorded
- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.
At a glance
The checks that decide most of this verdict.
| Malware engines | 17 flagged itVirusTotal | Risk |
|---|---|---|
| Google Safe Browsing | Not listedGoogle | Clear |
| Abuse reports on the host | 0% confidenceAbuseIPDB, 86 reports; shared hosting inflates reports | Clear |
| Domain age | Not availableNo registration record was returned | Noted |
| Web archive | Never archivedNo public history of this site | Watch |
| Certificate | Encrypted connectionIssued by WR1 | Noted |
The page as captured
Key findings
- Automated classification: Sensitive Interaction Risk.
- At least one reputation service TrustSniffer consulted had flagged this domain at assessment time.
Full analysis
Security Alert
Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.
This website is a subdomain on a shared application-hosting platform. Its homepage, as captured, serves only a short "not found" error page with almost no readable content. It presents no product, service, brand, or business model to a visitor, so its apparent purpose cannot be established from visible content. Observed behavior in an instrumented browser is more telling than the page text: the page changes materially after interaction and generates a very large volume of outbound requests to third-party destinations.
Scam/Impersonation Risk
This is an elevated-risk site. Several leading security vendors currently classify it as malicious, and a further smaller group marks it as suspicious. This is a confirmed blacklisting and the decisive factor in the assessment. Behavioral testing adds to it. The page showed strong cloaking: the content shown after interaction differed substantially from what loaded initially, which is a pattern associated with serving different material to scanners and to real visitors. Almost all observed traffic went to external destinations, and many requests were outbound submissions. These external destinations were not flagged as non-whitelisted. No wallet-connection, wallet-drainer, clipboard-hijack, or hidden-form activity was recorded. No conflicting legal identities or brand impersonation were observed, so the concern comes from reputation and behavior, not from identity contradictions. A large number of abuse reports exist against an address used by the hosting provider. The reports relate to shared platform infrastructure and have been discounted. They are not attributed to this site and carry no weight in the conclusion.
- Homepage: 17 security engines flag the domain as malicious and 2 as suspicious, including three tier-one vendors, which triggered an automatic critical-risk override.
- Homepage behavior: strong cloaking was detected after interaction (semantic difference about 8.6 and visual difference about 8.3, over 3 successful runs).
- Network behavior: 82 external requests were observed, including 70 external XHR/fetch calls and 12 external POSTs, with up to 99.5% of activity directed off-domain in one run.
- Hosting-address reputation: 86 abuse reports apply to a shared provider address (Vercel, whitelisted, confidence score 0) and are discounted as shared-infrastructure noise.
Regulatory Verification Notes
The captured homepage is an error page, so no legal, terms, privacy, about, or contact content could be assessed. No operator name, licensing status, or registration number is shown. Ownership and governance are opaque, and the real-world operator is not independently verified. This is an administrative limitation of the content, not an identity contradiction and not a finding of wrongdoing. Third-party broker reputation data returned no match for this site, so there is no broker-level signal either way. Only the transport layer provides any positive evidence: a valid certificate from a recognized issuer. That is a basic hygiene control and does not establish legitimacy.
- Homepage: returns an HTTP 404 error page titled "404: NOT_FOUND" with only a few hundred characters of text and no disclosures.
- Transport encryption: TLS certificate issued by WR1 (DV, domain-validated only), valid to 2026-11-27, with 36 days remaining.
- Hosting: served from AS16509 (AMAZON-02 - Amazon.com, Inc., US) in the United States.
- No broker-database match was found for the domain.
What to Verify Next
Because the site is blacklisted and shows cloaking, verification should come before any interaction, and it should rely on independent sources. The first step is to identify who operates this deployment and why the link was provided. Ask the party that supplied the link to confirm it through a separate, known channel. Next, check whether the real organization the visitor expected publishes an official address elsewhere, and compare it with this one. Re-check the domain against several independent reputation services after some time has passed. If the site is a compromised or abandoned deployment, a clean result may appear only after the owner remediates it. Any official contact or support channel should be confirmed offline, not through this site.
- Homepage: no brand, operator, or business context is presented that a visitor could cross-check.
- Reputation: multiple security vendors currently flag the domain, so an independent re-check is the most direct way to see whether the listing changes.
- Hosting model: the domain is a subdomain of a shared hosting platform, so operator identity cannot be inferred from the domain name alone.
Summary Verdict
The overall posture is high-risk. Active third-party malicious classifications combined with evasive page behavior outweigh the site's technical hygiene and its absence of identity contradictions. Nothing observed supports treating the site as legitimate, and the operator remains unverified.
Infrastructure Integrity
The site is delivered through a reputable cloud and CDN/WAF provider on AS16509 (Amazon), with several edge addresses and no observable origin server. Resolution is stable and the setup is conventional. This is a mitigating factor only. Edge-only visibility prevents independent confirmation of where content is actually hosted, and it can conceal rapid content swaps. Protective infrastructure cannot offset the reputation findings.
Closing Assessment
The site should be treated as unsafe for any sensitive action. This means no login, no credential entry, no payments or other financial activity, and no downloads. At most, view it from an isolated environment, and only if viewing is necessary. If the link arrived unsolicited, it is best discarded and reported to the party that sent it.
Written analysis generated 2026-10-22 by the TrustSniffer Analysis Engine from the evidence in this report.
What the analysis found
3 findings contributed to this verdict, raised by external reputation, behaviour in a sandbox, registration and ownership.
01 External reputation
- An external threat feed lists this domain: either Google Safe Browsing marked it malicious, or a significant number of malware engines flagged it.External reputation
rule:EXT_BLACKLIST_CRITICAL
02 Behaviour in a sandbox
- Most of what the page loaded came from other domains rather than from this one.Behaviour in a sandbox
rule:BEHAV_EXTERNAL_RATIO_HIGH - The page made many background requests to other domains while it was open.Behaviour in a sandbox
rule:BEHAV_EXTERNAL_XHR_HEAVY - The page sent data to other domains many times while it was open.Behaviour in a sandbox
rule:BEHAV_EXTERNAL_POSTS_HEAVY
03 Registration and ownership
- The public registration record for this domain is incomplete.Registration and ownership
rule:KF_WHOIS_INCOMPLETE
Signals weighed against the site
- AbuseIPDB: 86 reports on hosting IP 64.29.17.67 (Vercel, Inc, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.
Identity verification
| Status | UNKNOWN |
|---|---|
| Identity score | 50/100 |
| Identity verification confidence | 30% |
- AI page analysis unavailable (page captured; identity not AI-verified)
Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence.
What TrustSniffer observed
First-party facts recorded during the assessment of pi-theta-five.vercel.app.
- The request stayed on pi-theta-five.vercel.app. It was not redirected to another domain. Clear
- It is hosted on AMAZON-02, from a server in US. Noted
Domain intelligence
| Registrar | Not available |
|---|---|
| Hosting | AMAZON-02 - Amazon.com, Inc., US |
| Country | US |
| Server IP | 64.29.17.67 |
| Name servers | Not available |
| CDN / edge network | Detected |
| Resolved IP addresses | 6 |
| Edge IP addresses | 6 |
| Likely origin IP addresses | 0 |
| SSL issuer | WR1 |
| SSL expiry | 2026-11-27 |
| Domain age | Not available (no registration date was returned) |
| Domain expiry | Not available |
| Archive first seen | Not available |
| Archive snapshots | 0 |
| Reputation | VirusTotal: 17 flagged | AbuseIPDB: 0% confidence, 86 reports | Google Safe Browsing: 0 matches |
About this assessment
A trust score summarises the evidence TrustSniffer could collect about pi-theta-five.vercel.app at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.
TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.