Is presalefarm.pages.dev safe? TrustSniffer's low-trust assessment: 26/100

Overview

Presale Farm is a single-page website served from a free subdomain of a developer hosting platform. Its page title presents it as "Presale Farm", which suggests a token presale or yield-farming style crypto offering. The captured homepage carries only a small amount of text. Its apparent purpose, and the identity of whoever operates it, could not be established from the available evidence.

Scam/Impersonation Risk

The assessment is cautionary and driven by external reputation. Several independent threat-intelligence sources currently classify this domain as malicious or suspicious, and it also appears on an external blacklist. These are confirmed contradictions, and they are decisive for sensitive interactions. No conflicting legal identities and no brand impersonation were observed. No phishing form was captured, so the concern rests on the third-party detections and not on a demonstrated credential-harvesting page. The behavioral run was mixed. It showed no wallet-connection prompts, no wallet-drainer behavior, no clipboard manipulation, no hidden forms, and no cloaking. It also showed that about nine in ten requests during the visit went to external hosts, including many background data calls and a number of external POST submissions. A few of those destinations are outside the commonly recognized set, and the page logged repeated script errors. Heavy dependence on third-party endpoints is consistent with a thin front-end shell. It does not explain the detections, and it prevents the page's data flows from being treated as benign. The site's age and archive history are short and unremarkable, so they offer no counterweight to the reputation findings. Evidence:

• Homepage and domain-level reputation: three security engines flagged the domain as malicious and one as suspicious, and an external blacklist also lists it.
• Homepage behavioral capture across three runs: 78 external XHR/fetch calls, 12 external POSTs, about 92% of requests external, 3 non-whitelisted destinations, and 8 console errors.
• Homepage behavioral capture: no wallet-drainer, clipboard-hijack, hidden-form, or cloaking activity.
• Domain provenance: registration continuity of about 2.25 years, with 11 archive snapshots spanning 2024–2026 (3 years tracked), first seen 2024-07-28 and last seen 2026-08-02.

Regulatory Verification Notes

The captured homepage names no operating company, jurisdiction, licence, or registration number, and no terms, privacy, or risk-disclosure content was evident. For a site whose title implies a presale or farming offer, this is a content gap on the website's own side. The gap is a verification matter and not proof of wrongdoing, but here it sits alongside confirmed reputation findings. The site is on a shared platform subdomain, so the domain name conveys no brand or institutional identity. No third-party broker or regulator record matched this site. The site's TLS certificate is valid but is only domain-validated. It encrypts traffic and does not attest to the operator's identity. Real-world operator identity remains unverified. Evidence:

• Homepage: no company name, licence, registration number, or risk disclosure in the captured content, which is only a few hundred characters of text.
• Site-wide: no matching broker or regulatory-registry record in third-party reputation data.
• Transport encryption: TLS certificate issued by WE1 (DV), valid to 2026-12-01 with 32 days remaining.
• Hosting: served from AS13335 (Cloudflare, Inc., US).

What to Verify Next

Any claim that this is a legitimate presale or farming project should be tested against sources the site does not control. The project's official channels should be located independently, for example through a recognized token or project directory or the team's established social accounts, and not through links on this page. The operating entity, its jurisdiction, and any licence it claims should be confirmed with the relevant registry. Before any interaction, the current detection status of the domain should be re-checked with the major reputation services. Any terms, whitepaper, or audit the site claims to have should be retrieved and cross-checked at their original sources. Evidence:

• Homepage: no operator identity or licensing details are published, so confirmation must come from external registries.
• Domain-level reputation: multiple active detections mean the current status should be re-checked before any decision.
• Official contact and project channels should be confirmed through an independent route.

Summary Verdict

The available evidence supports an elevated-risk, low-trust posture. Active third-party malicious classifications and a blacklist listing outweigh the neutral and positive technical signals, which are a valid certificate, stable page delivery, and no observed wallet-drainer or cloaking behavior. Those signals show only that the page loads normally. Legitimacy cannot be inferred from them, and the operator's real-world identity remains unverified.

Infrastructure Integrity

The site is delivered through Cloudflare's CDN and web-application firewall. All observed addresses are edge servers, and the origin host was not visible. This protective layer is a mitigating factor only. It makes independent hosting verification harder and does not offset the external reputation findings.

Closing Assessment

Read-only viewing is the only proportionate use. Logging in, entering credentials, connecting a wallet, or sending funds should be avoided until the detections are cleared and the operator is independently identified.