Is presale99bitcoins.pages.dev a scam? TrustSniffer's high-risk assessment: 5/100

Overview

This website is a single-page cryptocurrency promotion titled "99Bitcoins Token Presale: Now Open". It is served from a free shared Cloudflare Pages subdomain, not from a standalone branded domain. It presents itself to visitors as an early-access sale of a token under the 99Bitcoins name. Its apparent purpose is to solicit purchases or commitments of funds ahead of a token launch.

Scam/Impersonation Risk

The most serious finding is that the site is blacklisted: several independent threat-intelligence engines currently classify it as malicious, and historical records also associate it with known phishing activity. That convergence is decisive and outweighs every benign technical attribute. The site trades on the 99Bitcoins name, but it runs from a generic hosting subdomain that cannot be tied to that brand. Nothing independently links the page to a real-world operator, so the presale reads as a probable brand-borrowing lure, the pattern typical of fraudulent token-presale campaigns. No conflicting legal entities were observed, so this is not an identity contradiction. The risk comes from the threat listings and the unverifiable use of a brand name around a funds-solicitation offer. Automated interaction testing found no wallet-drainer behavior, no clipboard tampering, no hidden forms and no cloaking. That is mildly mitigating, but it does not offset the listings, because malicious presale pages often turn harmful only at the point of payment or wallet signing. Evidence:

• Homepage: the page title advertises a "99Bitcoins Token Presale" that is open for participation, on a shared hosting subdomain rather than a dedicated brand domain.
• Reputation checks: five engines flagged the site as malicious and one as suspicious, and an external blacklist listing is active.
• Domain provenance: continuous presence of about 2.1 years, with 10 archive snapshots from 2024-09 to 2025-03 (2 years tracked), but with a known-phishing association in the historical record.
• Behavioral testing: 75 external background requests and 9 external POST submissions across 3 runs, 9 console errors, no wallet-connect or drainer activity detected.

Regulatory Verification Notes

The presale makes a financial-product claim, an offering of a token to the public. The evidence gives no basis for treating it as a regulated or licensed offering, and no regulator or registry records support it. Page-level identity analysis could not confirm any operator, company or disclosed legal entity, so the site's real-world identity remains unestablished. The third-party broker-reputation dataset returned no match for the site. That is neither a clearance nor a warning, and it is not a licensing verdict. This section records the absence of verifiable regulatory standing. The threat listings described above, not this absence, drive the cautionary assessment. Evidence:

• Homepage: the offering is a token presale, with no confirmed licensed operator or registered entity behind it.
• Hosted on AS13335 (Cloudflare, Inc., US).
• TLS certificate issued by WE1 (DV, domain validation only), valid to 2027-01, so it confirms encryption but not the operator's identity.

What to Verify Next

Do not treat this presale as legitimate unless the 99Bitcoins brand independently confirms it. Confirmation should come from contact details the reader already holds or sources the reader finds independently, never from links or addresses on this page. Any claim of a token offering should be checked against the securities or financial-services registry of the reader's jurisdiction. Official support and contact channels should be confirmed through an independent route before any further engagement. If the page has already been visited, any wallet that was connected or any credential that was entered should be reviewed and its approvals revoked. Evidence:

• Homepage: the brand claim and the presale offer are made only on this hosting subdomain.
• Threat listings: the active malicious classifications mean any link or payment instruction on the page should be treated as untrusted.
• Certificate: the DV-level TLS certificate attests only to domain control, so it is no proof of the operator's identity.

Summary Verdict

The site carries an elevated, critical-level risk posture. Active malicious classifications from multiple independent sources define the assessment. Hosting stability and a valid certificate do not establish legitimacy, and the operator's real identity is unconfirmed. The available evidence is consistent with a deceptive or harmful token-presale page, not an established, trustworthy website.

Infrastructure Integrity

The site is delivered through Cloudflare's CDN and WAF, and all observed addresses are edge servers, so the origin host is not visible. This is a mitigating factor only. The setup is common to legitimate and malicious sites alike, and it also prevents independent verification of where the content actually runs. It cannot offset the reputational findings. The certificate is valid and issued by a recognized authority, which indicates normal operational hygiene but nothing about intent.

Closing Assessment

The site should be treated as unsafe for any sensitive interaction. Do not log in, connect a wallet, sign transactions, supply personal data, or send funds. If the page must be examined, do so read-only and from an isolated environment. Anyone who received the link through email, social media or messaging should report it to the platform and the relevant fraud authorities.