Is Pages a scam? TrustSniffer's high-risk assessment of riverairdrop.pages.dev: 0/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

The website is a publicly hosted web property on a shared Cloudflare Pages subdomain whose name ("riverairdrop") suggests a cryptocurrency token-airdrop or giveaway promotion. The page captured during analysis was not a normal storefront or dashboard. It was an interstitial challenge page titled "Suspected Phishing", served with an access-denied response. It presents the visitor with a warning rather than content, and its apparent purpose cannot be confirmed beyond the airdrop-style branding in its address.

Scam/Impersonation Risk

Confirmed contradictory signals are present, and the posture is explicitly cautionary. Multiple major security vendors independently classify this domain as malicious, which amounts to a confirmed blacklisting. Those detections include several top-tier endpoint-security vendors, and their number and breadth alone are decisive. The page presented to the automated visitor was a phishing-warning interstitial, which is consistent with the domain having been flagged as a phishing or credential-harvesting destination. Airdrop-branded sites on free subdomains are a common vehicle for wallet-draining and fake-claim schemes. The address also closely resembles the generic hosting platform's own domain, which is typical of low-effort lookalike deployments. No conflicting legal entities or brand impersonation of a named company were identified, and the page's text was too limited to show which specific lure is used. Behavioral testing found no wallet-connection prompts, clipboard tampering, hidden forms or external password forms in the captured session. That does not offset the reputation findings. The captured session was limited by the access challenge, so it cannot rule out behavior that only appears for a real, unchallenged visitor. Evidence:

• Homepage: the captured page was titled as a suspected-phishing interstitial and returned an access-denied status after a bot challenge.
• Threat-intelligence reputation: 13 security engines flagged the domain as malicious, including three tier-one vendors, which triggered an automatic critical cap.
• Homepage network behavior: about 94% of observed requests went to external destinations, with 15 external data requests and 5 external POST submissions across three test runs, and 18 console errors.
• Domain structure: the address is a subdomain of a shared hosting platform and closely mimics that platform's parent domain.

Regulatory Verification Notes

The captured page showed no legal, licensing, terms or about content. No company name, registration number, regulator reference or jurisdiction could be assessed. Nothing on the site supports a claim of regulated status, and no independent regulatory listing was found for it. No broker-reputation record matches it either. The absence of this information is not by itself evidence of fraud. Here it comes alongside confirmed security detections, so the site offers no countervailing assurance. A valid, publicly trusted transport-encryption certificate is present. It is only a domain-validated credential, which confirms an encrypted connection and not the operator's identity or intent. Evidence:

• Homepage: no legal-entity name, license, terms or privacy content was observable in the captured page.
• Hosting: served from AS13335 (Cloudflare, Inc., US).
• Transport encryption: TLS certificate issued by WE1 (DV, domain validation only), valid to 2027-01-04.
• Third-party broker reputation: no matching record, so no regulatory or reputational context is available from that source.

What to Verify Next

Any dealings with this site should wait until independent confirmation exists that the promotion is genuine. A person who reached the site through a message, advertisement or social post should trace the offer back to the official channels of the project it claims to represent, such as the project's own verified website and announcements. Any wallet addresses, claim links or token contracts should be compared with those official sources before being used. If the site is claimed to be a legitimate project, the owner should be asked for a verifiable corporate identity and regulatory status through an offline or otherwise independent route. If a legitimate owner believes the domain was wrongly flagged, they should request a review from the flagging vendors and from the hosting platform. Evidence:

• Homepage: the airdrop-style naming is the only indication of purpose, so the claim must be confirmed against the project's official channels.
• Reputation findings: the malicious classifications have not been cleared, so independent reconfirmation of the domain's status is warranted.
• Shared hosting: the site sits on a free subdomain, so the account holder can be identified only through the hosting platform's abuse process.

Summary Verdict

The overall posture is critical and clearly adverse. Convergent third-party malicious classifications and a phishing-warning interstitial outweigh the site's technical hygiene. The available evidence supports treating it as a probable threat vector, not as an established or neutral website. The operator's real-world identity remains unestablished.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and WAF. All four observed addresses are edge nodes, and no origin server could be observed. This is standard, reputable protective infrastructure, and the access challenge that blocked the capture reflects the platform's own bot controls. It is a mitigating factor only. It cannot offset the threat detections, and edge-only visibility prevents independent confirmation of where the content is actually hosted.

Closing Assessment

The site should be treated as read-only at most, and preferably not visited at all. Credentials, wallet connections, seed phrases, personal data and payments should not be entered or sent. Nothing should be downloaded from it. Anyone who has already interacted with it should revoke any wallet permissions granted and change any reused passwords.