Is Pages a scam? TrustSniffer's high-risk assessment of pocketnet.pages.dev: 0/100

Overview

This website is a minimal single-page deployment on a free Cloudflare Pages subdomain, and it presents itself under the title "GMGN". The landing page carries only a few dozen characters of visible text. It shows no named products, pricing, company description or stated service. Its business purpose cannot be determined from what it displays, and the hostname and page title do not match.

Scam/Impersonation Risk

Confirmed contradictions are present, and they point to an elevated risk of malicious use. Several independent threat-intelligence engines currently flag the domain as malicious or suspicious, and a separate external blacklist also lists it, so it is blacklisted in the strict sense. Behavioral testing adds a second, independent concern. After simulated interaction, the homepage changed materially in both its text and its appearance. This is strong evidence of cloaking, meaning the site shows different content depending on how it is approached. Cloaking is a technique commonly used to evade scanners and reviewers. The hostname refers to one name and the page title to another, and nothing on the page explains the relationship. No confirmed impersonation or conflicting legal identities were observed, so the mismatch is an unreconciled naming discrepancy, not a proven brand abuse. Several background requests also went to third-party destinations outside the expected set, including one unrecognised destination. Testing found no wallet-connection prompts, drainer behavior, clipboard manipulation, hidden forms or credential posts to external hosts. The concern is therefore the reputation listings and the shifting content, not a captured credential-harvesting flow. The site's short history does not offset these signals. Evidence:

• Homepage: after interaction, the page's content shifted measurably in both text and visual layout, which behavioral testing classed as strong cloaking.
• Homepage: six external background requests were observed, three of them to non-allow-listed destinations, and the page produced three console errors.
• Domain provenance: only 3 archive snapshots, spanning 2024–2026 (first captured December 2024, about 1.9 years of domain age), so there is no deep, stable history to counterbalance the listings.
• Reputation sources: two engines rated the domain malicious and one suspicious, alongside an external blacklist hit.

Regulatory Verification Notes

The captured homepage contains no legal, terms, privacy or about content. It names no operating company, registration number, licence or regulator, so the on-page disclosure position is unclear. This is a verification gap and not proof of wrongdoing, but it leaves the real-world operator unidentified. Any claim that the site belongs to a known brand or business is unsupported by the evidence. No third-party broker or regulator match was found, and the site presents no regulated activity that would call for a licence. The valid transport encryption confirms only that the connection is encrypted. It says nothing about who runs the site or whether they can be trusted. Evidence:

• Homepage: roughly 88 characters of visible text and no identifiable legal, ownership or licensing statement.
• Site hosting: served from AS13335 (Cloudflare, US).
• Transport encryption: a domain-validated TLS certificate from issuer WE1, valid to 2026-12-23, which verifies the domain only and not the operator.

What to Verify Next

Before any interaction, confirm independently whether the brand suggested by the page title operates or authorises this deployment. Use that brand's officially published channels, not anything reached through this site. Re-check the domain's current reputation status after any claimed remediation, since the listings are active now. If the site later publishes an operator name or licence, confirm it directly with the relevant registry and compare it against the hostname and title. Confirm the official support and contact channels through an independent route. Evidence:

• Homepage: the title and hostname refer to different names, with no on-page statement linking them.
• Homepage: no operator, legal or contact disclosures were present to cross-check.
• Reputation checks: the malicious and suspicious detections were current at the time of analysis.

Summary Verdict

The domain carries a clearly cautionary, high-risk posture. Active third-party threat detections and strong evidence of cloaking converge on the same conclusion, and the site's thin content and short history give no legitimising counterweight. Its legitimacy and operator identity are unestablished, and its current reputation is adverse.

Infrastructure Integrity

The site is delivered through Cloudflare's CDN and WAF, and every observed address is a Cloudflare edge address. The origin server was not observable in this analysis. This is ordinary for a Cloudflare Pages deployment, and the provider's reputation is clean. Edge-only visibility prevents independent verification of where the content is hosted and can mask rapid content swaps. This protective infrastructure is therefore a mitigating factor only, and it cannot offset the external threat detections.

Closing Assessment

The site should not be used for login, credential entry, payments or any financial interaction, and nothing should be downloaded from it. If a visit is unavoidable, it should be limited to read-only viewing from an isolated, non-sensitive environment.