Is rewards-paal-ai-6da.pages.dev a scam? TrustSniffer's high-risk assessment: 5/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a single-page promotional site hosted on a free-tier developer-platform subdomain. Its title reads "PAAL AI | Create and Integrate Advanced Crypto & AI Bots." It presents itself as a crypto and AI-bot tooling offering, and a "rewards" label in the hostname suggests a token or incentive-distribution pitch. The apparent purpose is to attract visitors to a crypto-themed AI product or rewards programme. The site's independent link to any established real-world brand or operator has not been confirmed.

Scam/Impersonation Risk

This is the decisive area of the assessment. Multiple major security vendors currently flag the site as malicious. Together with an additional suspicious detection, that is enough to place it on an external blacklist. The detections are sufficient to override every positive signal. The hostname imitates a known crypto-AI brand ("PAAL AI") but sits on a generic, free developer-platform subdomain, not on any recognisable brand-owned domain. The brand-and-subdomain mismatch and the confirmed threat detections together form the pattern typical of crypto-themed lure sites. They are used to drive visitors toward wallet connections, "reward" claims, or credential entry. No conflicting legal entities were observed. The identity of the real operator remains unconfirmed, and the site cannot be treated as an authentic presence of any brand it evokes. Automated behavioural testing was reassuring in some respects. It found no wallet-connection prompts, no wallet-drainer behaviour, no clipboard manipulation, no hidden forms, no external password forms, and no content cloaking. However, the page issued a heavy volume of third-party requests, including several outbound data submissions. That activity does not offset the threat detections. Behaviour observed in a short test session also does not rule out later content swaps. Evidence:

• Homepage: the title presents a crypto and AI-bot product under a "rewards" hostname on a shared free-tier platform subdomain, not a brand-owned domain.
• External reputation: several leading security vendors flag the site as malicious, and the blacklist condition is confirmed.
• Behavioural testing of the homepage: 88 third-party XHR/fetch requests and 9 external POST submissions across 3 runs, with no wallet, clipboard, hidden-form, or cloaking activity.
• Domain provenance: about 2 years old (~2.05 years), with 12 archive snapshots spanning 2024–2025 (2 years tracked, first captured October 2024).

Regulatory Verification Notes

The homepage carries no verifiable regulatory or corporate identity that could be checked independently. Automated page-content analysis could not confirm any operator, licence, or registration claim. The site therefore offers no independently verifiable basis for any financial-services or token-distribution activity. This is a verification gap only. The elevated risk rests on the external threat detections, not on this gap. No third-party broker or regulatory-database listing matched the site, so there is no reputational signal from that channel in either direction. The valid transport encryption is a baseline hygiene measure available to any site, including malicious ones, and does not support legitimacy. Evidence:

• Homepage: no company name, licence, or registration reference could be confirmed from the captured content.
• Hosting: served from AS13335 (Cloudflare, Inc., US).
• Transport encryption: TLS certificate issued by WE1 (DV, domain validation only), valid to 2026-12-13.

What to Verify Next

Any contact with this site should start from an independent check of whether the "PAAL AI" brand it evokes actually operates it. This means finding the brand's official domain and social accounts through independent sources, not through links on this site, and comparing them to this hostname. The official channels should also confirm whether any rewards, airdrop, or bot programme exists, since a genuine programme would be announced there. Any financial or token-related claim should be checked against the relevant regulator's public register. Support and contact channels should be confirmed through an independent route before any correspondence. Evidence:

• Homepage: the brand claim and the "rewards" hostname are unconfirmed and need cross-checking against official brand channels.
• Domain: the site runs on a shared platform subdomain, so ownership cannot be inferred from the hostname.
• Reputation: the confirmed vendor detections should be re-checked after any claimed remediation.

Summary Verdict

The site is assessed as a critical-risk destination with a clearly cautionary posture. Confirmed external threat detections and the brand-versus-subdomain mismatch outweigh every neutral or positive technical signal. Real-world operator identity remains unverified, and the site should be treated as hostile until independent evidence shows otherwise.

Infrastructure Integrity

The site is delivered through Cloudflare's CDN and WAF. All four observed IP addresses are edge servers, and the origin server was not observable. This is a mitigating factor only. It shields the underlying host from direct exposure, but it prevents independent hosting verification and can mask rapid content swaps behind the same endpoint. Trusted infrastructure cannot offset the reputational risk here, and its protections do not extend to the safety of the content served.

Closing Assessment

Account login, credential entry, wallet connection, and any financial or token transaction on this site should be avoided, and nothing should be downloaded from it. At most, it should be viewed read-only in an isolated environment. Anyone who has already entered credentials or connected a wallet should change those credentials and revoke wallet permissions immediately.