Is Pages a scam? TrustSniffer's high-risk assessment of pushd-icu.pages.dev: 5/100

Security Alert

Fortinet, Google, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a subdomain on a shared static-site hosting platform. The only content captured for a visitor was a platform security interstitial titled "Suspected Phishing", returned with an access-denied status behind a bot challenge. No products, branding, operator name or business purpose could be read from the page itself. The address reads like a project name placed on a free hosting namespace, and its apparent function is a credential-collection or social-engineering landing page rather than a recognizable commercial service.

Scam/Impersonation Risk

This assessment is clearly cautionary. Multiple independent security engines, including several tier-one vendors, currently flag the site as malicious, and a major browser-protection service classifies it under social engineering. That makes this a confirmed blacklisting and a decisive finding. Infrastructure protections and a valid certificate cannot offset it. The hosting platform's own interstitial labels the site as suspected phishing, which independently supports the threat-intelligence listings. The site has no identity of its own. It sits on a shared platform namespace, so it borrows the platform's apparent legitimacy, and the domain is nearly identical in form to the platform's own domain. Sandbox runs did not observe wallet-drainer behavior, clipboard hijacking, hidden forms, or credential posts to external hosts. However, the page generated a very high share of third-party requests and numerous script errors, and its content changed substantially after interaction. These are consistent with a thin or templated front end loading remote resources. No conflicting legal entities were observed, but the confirmed listings alone are enough to treat the site as hostile. Evidence:

• Homepage: the captured page was the platform's "Suspected Phishing" warning, served with an access-denied status behind a bot challenge.
• External reputation: multiple tier-one security vendors and the major browser-protection service flag the site as malicious, the latter under social engineering.
• Homepage behavior: nearly all observed requests went to third-party hosts, with 17 console errors and a large page-structure change after interaction.
• Domain provenance: about 1.9 years old, with only 3 archive snapshots in a single tracked year (all captured on 2024-12-14), so there is no meaningful history.

Regulatory Verification Notes

No licensing, registration or legal-entity information could be observed. The only content available was the warning interstitial, so no terms, privacy, about or contact pages could be assessed. The real-world operator is therefore not independently connected to any brand, company or regulated activity. No third-party broker or regulatory-database entry matches this site. Without any identifiable operator or authorization, the confirmed threat listings stand as the dominant indicator, and nothing can mitigate them. Evidence:

• Homepage: no company name, license number or regulator reference appears in the captured content.
• Third-party registries: no match against broker-reputation records.
• Technical telemetry: served from AS13335 (Cloudflare, Inc., US).
• Technical telemetry: TLS certificate issued by WE1 (DV, domain validation only), valid to 2026-12-22.

What to Verify Next

Anyone who received this address through an email, message, advertisement or QR code should trace it back to its source and treat the source as suspect. If the link claims to represent a named company, the company's official channels should be located independently, through a search or an offline route, and asked whether the link is genuine. Organizations should block the address in web and email gateways and report any credentials already entered to their security team for immediate rotation. Re-testing is only worthwhile after the platform removes the warning and the security vendors delist the site. Evidence:

• Homepage: the platform's interstitial indicates the content is already under abuse review.
• Reputation listings: current malicious classifications remain active across multiple vendors.
• Domain history: the very short archive record offers no earlier legitimate use to fall back on.

Summary Verdict

The site sits in a critical-risk posture. Confirmed malicious classifications from multiple independent sources, together with the absence of any identifiable operator or legitimate business footprint, outweigh the technically sound transport security and the shared-platform hosting. The available evidence points to a site that is hostile or abused, and no reading of it supports a reassuring conclusion.

Infrastructure Integrity

The site is served entirely from Cloudflare's CDN and WAF edge network, and every observed address belongs to edge servers. The origin host is not observable, so independent hosting verification is not possible. Bot protection and a valid DV certificate show that the transport layer is functional. Both are standard on shared platforms and say nothing about the operator's intent. They are mitigating factors only and do not offset the reputation findings.

Closing Assessment

The site should not be visited with a normal browser, and no credentials, payment details, wallet connections or downloads should be exchanged with it. Anyone who has already interacted with it should change affected passwords, review account activity, and report the link to their security team or the relevant platform abuse channel.