Is Pages a scam? TrustSniffer's high-risk assessment of rpcsync.pages.dev: 5/100

Security Alert

Fortinet, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a project hosted on a free Cloudflare Pages subdomain, with the name "rpcsync" suggesting a blockchain RPC or wallet-synchronisation utility. When the analysis tried to load the homepage, it received an access-denied bot-challenge screen titled "Suspected Phishing", so little original content could be read. The site presents no readable company, product or service description, and its business purpose cannot be confirmed from the content collected.

Scam/Impersonation Risk

The evidence shows elevated risk and confirmed adverse third-party reputation. Several major security vendors flag the domain as malicious or suspicious, and the site is blacklisted by external threat sources. That is a hard contradiction and the decisive factor in this assessment. No conflicting legal identities, brand impersonation or credential-harvesting forms were observed. However, the blacklisting alone is serious. The domain also has a close lookalike relationship to its parent hosting domain, which is typical of lures that imitate infrastructure or utility tooling. The homepage was served behind a challenge page labelled as suspected phishing, so the visible content is itself a warning. The domain is only about two years old, and its name implies a wallet or node-connection utility, a category that attackers routinely mimic to capture seed phrases or wallet approvals. The site should therefore not be used for login, credential entry, wallet connection or any financial interaction. Behavioural testing found no wallet-drainer, clipboard-hijack or hidden-form activity. That is a mitigating observation only and does not offset the external detections. Evidence:

• Homepage: capture returned an access-denied status and a bot-challenge page titled "Suspected Phishing", so no first-party content could be reviewed.
• Reputation sources: multiple major security vendors, including two top-tier vendors, flag the domain, and the external blacklist check is positive.
• Behavioural testing (3 successful runs): no wallet-provider calls, drainer behaviour, clipboard writes or external password forms. About 95% of external traffic went to third-party destinations, 16 external XHR/fetch calls and 6 external POSTs occurred, and 18 console errors were logged.
• Domain provenance: registered about 2 years ago, with 12 archive snapshots spanning 2024–2026 (3 years tracked) and no sign of repurposing.

Regulatory Verification Notes

No legal, terms, privacy or about pages could be reviewed, because the only content retrieved was the challenge screen. No licence, registration number or corporate identity was available for assessment. No regulator or third-party registry match was found, and no broker-reputation record matched this domain. This leaves the operator's identity unestablished and is a verification gap. It is not evidence of a scam on its own, but alongside the confirmed reputation signals it prevents any claim of legitimacy. The site's transport encryption is valid but is a basic domain-validated certificate. It confirms only an encrypted connection, not the operator's identity or trustworthiness. Evidence:

• Legal and identity pages: none accessible, so no company name, licence or registration details were observable.
• Third-party regulatory and broker checks: no match found.
• Transport encryption: TLS certificate issued by WE1 (DV), valid to 2026-12-12.
• Hosting: served from AS13335 (CLOUDFLARENET – Cloudflare, Inc., US).

What to Verify Next

Any contact with an entity claiming to run this service should begin by establishing who the operator is through an independent route, such as an official project website or documentation reached from a known, trusted source, not from this domain. If the site is linked in a message, advertisement or social post, the sender should be asked to confirm the destination through a separate channel. Anyone who has already connected a wallet, approved a transaction or entered credentials here should treat those assets as exposed, revoke token approvals and move funds to a fresh wallet. The domain owner or hosting abuse desk should be asked to review the flagged content. If the owner is a legitimate developer whose project was compromised or mistakenly flagged, the reputation status may change after remediation. Evidence:

• Homepage: the challenge page makes the real service unobservable, so any legitimate offering must be confirmed from an independent source.
• Reputation findings: detections are current, so the site's status should be rechecked after any remediation.
• Hosting: the site sits on a shared hosting subdomain, so the platform's abuse process is the appropriate escalation point.

Summary Verdict

The assessment is elevated risk with a cautionary posture. Current threat-intelligence detections outweigh the site's technical hygiene and its history of continuous availability. The operator is unidentified and the content could not be reviewed. Legitimacy cannot be inferred from the evidence collected.

Infrastructure Integrity

The site is delivered through Cloudflare's CDN and web application firewall, so only edge addresses are visible and the origin server is not exposed. That setup protects against some network-level attacks and explains the bot-challenge response. Cloudflare's network is widely used by legitimate and malicious sites alike, so this is only a mitigating factor. It cannot offset the reputation findings, and it prevents independent verification of where the content is actually hosted.

Closing Assessment

The site should not be used for login, credentials, wallet connections or financial transactions. Users should leave the page and use only a service address obtained from an independently verified source.