Is roostwtf.pages.dev safe? TrustSniffer's moderate-trust assessment: 52/100

Overview

The website is a single-page site published on a free subdomain of a developer hosting platform, titled "$ROOST", whose name and branding suggest a token-themed or community-style project. It presents a short landing page with a moderate amount of text. Its apparent purpose is to promote or provide an entry point to a crypto-token-style venture, though the captured material does not clearly establish a business model or operator.

Scam/Impersonation Risk

This is the decisive area of concern. The domain is currently blacklisted by external threat-intelligence sources. Two independent engines classify it as malicious and a third as suspicious, and historical threat records also associate the domain with phishing-type activity. A third-party reputation signal of this kind is the strongest contradiction in the file. It raises the risk of sensitive interaction well above what the site's otherwise orderly technical presentation would suggest. No conflicting legal entities and no brand impersonation were observed, and no malicious on-page behaviour was captured in the sandbox runs. No wallet-drainer routines, clipboard manipulation, hidden forms, credential posts to external hosts, or content cloaking were seen. The page does generate heavy third-party traffic: roughly half of its network requests go to external hosts, with dozens of external background fetches, a dozen external POST submissions, a few destinations outside the commonly recognised set, and repeated script errors on load. For a page this small, that pattern is out of proportion and could conceal data flows or tracking, so the reputational flags cannot be dismissed as noise. Sites in this archetype, a token-branded page on disposable free hosting, are a common vehicle for short-lived promotion and wallet-targeting campaigns. Evidence:

• Homepage and domain reputation: two external engines flag the domain as malicious, one as suspicious, and it appears on an external blacklist.
• Homepage runtime behaviour: 78 external XHR/fetch calls, 12 external POSTs, about 52% of requests directed to external hosts, 3 non-allow-listed destinations, and 8 console errors across 3 sandbox runs.
• Homepage interaction tests: no wallet-connection abuse, clipboard writes, hidden forms, or cloaking detected.
• Web-archive record: 8 snapshots between September 2024 and March 2025, about 2 years tracked, with continuous content and no repurposing detected.

Regulatory Verification Notes

The sampled homepage names no operating company, licence, registration number, or jurisdiction, and the disclosure position remains unclear. Real-world operator identity has not been independently established, so the site cannot be treated as tied to any identifiable, accountable entity. No third-party broker or regulatory-database match exists, so no external reputational context is available in either direction. The absence of a licence is a verification gap, not proof of wrongdoing, but here it compounds the reputation concerns rather than standing alone. The sound transport encryption and orderly technical posture are consistent with a functioning site and do not establish legitimacy or accountability. Evidence:

• Homepage: no legal entity, licence, registration, or physical address is stated in the captured content.
• Transport encryption: TLS certificate issued by WE1 (DV, domain validation only), valid to 2027-01-13.
• Hosting infrastructure: served from AS13335 (Cloudflare, Inc., US).

What to Verify Next

Before any interaction, the operator should be identified through an independent route. That means checking whether any named team, company, or token issuer can be traced outside the site itself, and whether it holds registrations or licences in a relevant jurisdiction. Any social-media or community links should be confirmed from the project's own independent channels, not from this page. If the site is a token or investment-related venture, the token contract and any claimed audits should be checked on public blockchain explorers and with the auditors directly. Official contact channels should be confirmed offline. The site owner should also be asked to explain or remediate the external reputation flags, since a compromised page could produce the same signals. Evidence:

• Homepage: no named team, company, or verifiable project documentation in the captured content.
• Reputation record: the blacklisting is unresolved, and its cause (malicious use or compromise) is not established.
• Hosting model: the free-platform subdomain provides no independent ownership anchor.

Summary Verdict

Overall, the assessment is cautionary. Conventional technical hygiene and an unbroken but short archive history are outweighed by confirmed adverse reputation and unverified operator identity. The posture is elevated risk for any sensitive action. Passive viewing is the only use consistent with the evidence.

Infrastructure Integrity

The site sits behind Cloudflare's CDN/WAF, and every observed address is an edge node, so the origin server is not visible. This offers some protection against direct attacks and indicates mainstream, well-run delivery infrastructure. It is a mitigating factor only. Edge-only visibility also prevents independent hosting verification and makes rapid content swaps harder to detect, and the infrastructure cannot offset the reputational findings.

Closing Assessment

Account logins, credential entry, wallet connections, and any financial transactions on this site should be avoided until the external threat flags are cleared and the operator's identity is independently confirmed. Any visit should be limited to read-only viewing, from a device and browser profile that holds no valuable assets or saved credentials.