Is redirectsolutionprotocol.pages.dev safe? TrustSniffer's low-trust assessment: 42/100

Security Alert

Fortinet flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This is a website served from a subdomain of the pages.dev shared hosting namespace. Its name, "redirect solution protocol", suggests a redirection or routing utility, and no commercial offering, product description or operator identity could be read from it. When the site was captured, the visitor-facing response was a security interstitial headed "Suspected Phishing" from its edge provider, delivered with an access-denied status. Its apparent purpose therefore cannot be established from first-party content, and the only visible presentation is a warning page.

Scam/Impersonation Risk

Confirmed contradictions are present. Several independent external reputation sources currently flag the site: multiple security engines classify it as malicious, one of them a tier-one security vendor, and further engines mark it suspicious. This amounts to a confirmed blacklisting. A prior phishing association is also on record for the domain. The warning page returned at capture is consistent with those listings. No conflicting legal identities or brand impersonation were observed, so the risk rests on the blacklist and phishing indicators rather than on identity inconsistency. The risk is aggravated by the domain's profile: it sits on a free, shared hosting namespace, and its name closely resembles that namespace, which is a pattern commonly used for disposable redirect or lure pages. Behavioural testing found no wallet-connection prompts, clipboard tampering, hidden forms or credential posts to external hosts, which keeps this assessment from alleging active credential theft. However, a large share of requests went to external destinations, including a dozen external background requests and several external data submissions during a short session. All of these went to recognised destinations, but the pattern, together with repeated front-end errors, is the kind of redirect-oriented traffic the site's name implies. A reachable operator or legitimate service cannot be inferred from any of this. Evidence:

• Homepage capture: an edge-provider phishing-warning interstitial was served instead of site content, with an access-denied response.
• Reputation checks: three security engines rated the domain malicious and one suspicious, including a tier-one vendor, and the domain carries a known phishing history.
• Domain provenance: registered roughly 2.2 years ago (about 815 days), with 16 archive snapshots spanning 2024–2025 (2 years tracked, first seen July 2024, last seen March 2025).
• Behavioural sandbox, three runs: 12 external background requests and 6 external POSTs, all to recognised destinations; 12 console errors; no wallet, clipboard or hidden-form activity.

Regulatory Verification Notes

No legal, terms, privacy, about or contact pages could be assessed, because the capture returned only the interstitial. The site therefore presents no licence, registration number or corporate entity to test, and its on-site disclosure position remains unclear. Real-world operator identity is not independently established. No matching record exists in third-party broker reputation datasets, which is neutral context and neither a licensing finding nor a regulatory verdict. The domain's technical hygiene is ordinary: it holds a valid domain-validated certificate. That shows only that encryption is in place, and it says nothing about the operator's legitimacy or authorisation. Evidence:

• Homepage: no identity, licensing or registration statements were available in the captured response.
• Transport encryption: a domain-validated TLS certificate issued by WE1, valid to 2026-12-05 (43 days remaining at analysis).
• Hosting: served from AS13335 (Cloudflare, Inc., US).
• Broker reputation lookup: no match found.

What to Verify Next

Any dealings with this domain should wait until the party that supplied the link is independently confirmed through an offline or previously trusted channel. Anyone who claims to operate a redirect or protocol service from this address should be asked for a registered legal entity name and any applicable licence number. Those details should be checked directly in the relevant public registry rather than through the site. The listings should also be rechecked with the reporting security vendors, since site owners can have such flags reviewed or lifted after remediation. Official support or contact channels should be confirmed from a source independent of this domain. Evidence:

• Reputation checks: the current malicious and suspicious classifications are what any later reassessment would need to see cleared.
• Homepage: no named operator or licence claim exists to validate in a registry at present.
• Domain history: the short registration and archive record offers no long-standing track record to rely on.

Summary Verdict

The available evidence supports an elevated-risk, clearly cautionary posture. External security intelligence and the domain's phishing history outweigh the neutral technical signals, and nothing observed establishes a legitimate, identifiable operator behind the site. The domain should be treated as potentially hostile until the listings are cleared and an operator is independently confirmed.

Infrastructure Integrity

The site is fronted by Cloudflare's CDN and web application firewall, and every observed address is an edge address, so the origin server is not visible. The edge layer applied bot-challenge handling during testing, which is why the capture returned a warning page. This protective infrastructure is a mitigating factor only. It cannot offset the reputation risk, and it prevents independent verification of where the content is actually hosted.

Closing Assessment

Interaction should be limited to passive viewing, if it is needed at all. No account login, credential entry, wallet connection or payment should take place on this domain, and nothing should be downloaded from it. Any message or link that directed a user here should be treated as suspect and reported to the sender's organisation.