Is sale-creator-bid.pages.dev a scam? TrustSniffer's high-risk assessment: 22/100

Security Alert

Fortinet flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a single-page presence on a free, shared hosting subdomain. Its address uses the words "sale", "creator" and "bid", and it has no standalone domain of its own. The page captured at the root address was not site content. It was an interstitial notice titled as a suspected-phishing warning, and no legible products, services or business model could be retrieved. Its apparent purpose is therefore unclear, and the available evidence does not support treating it as an ordinary commercial or informational site.

Scam/Impersonation Risk

Confirmed adverse reputation is the decisive issue. Several independent threat-intelligence engines classify the site as malicious, with a further engine rating it suspicious, and at least one top-tier security vendor is among the flagging sources. The site is therefore blacklisted, and the web-archive history also carries a known-phishing marker. No conflicting legal entities and no specific brand impersonation were observed, so this is not an identity contradiction. The risk arises from the external detections and the phishing warning page. In the behavioral sandbox, the site's observed network traffic was overwhelmingly directed to third-party origins, with repeated external data requests and outbound POST submissions and a high rate of client-side script errors. All of those destinations fell within known, whitelisted services. No wallet-connection prompts, clipboard manipulation, hidden forms, credential forms posting to external hosts, or browser fingerprinting were detected, so there is no direct evidence of active credential or asset theft. That limits the confirmed finding, but it does not offset the blacklisting. The host label's sale, creator and bid wording is also a common lure theme for solicitation campaigns, though no page content confirms such use. Evidence:

• Reputation checks: 3 engines flagged the domain as malicious and 1 as suspicious, and the external blacklist check was positive.
• Homepage capture: the page returned an access-denied status and displayed a suspected-phishing notice instead of site content.
• Domain provenance: registered 2025 (~1.7 years old), a young domain.
• Web-archive depth: 4 snapshots spanning Feb–Mar 2025 (1 year tracked), a sparse history.

Regulatory Verification Notes

No legal, terms, privacy or about content could be assessed, so no licence, registration number or named operating entity is associated with this site. Operator identity is not independently established, and ownership opacity applies. This is a verification matter on its own and does not by itself indicate a scam, but here it coexists with confirmed adverse reputation signals. No third-party broker or regulator-sourced record matches this domain, so there is no reputational or licensing context that could mitigate the findings. The valid certificate is domain-validated only, which confirms encrypted transport and not who operates the site. Evidence:

• Homepage: no legal or corporate-identity disclosures were retrievable from the captured page.
• Transport encryption: TLS certificate issued by WE1 (DV), valid to 2026-12-05, with 39 days remaining.
• Hosting: served from AS13335 (Cloudflare, Inc., US).

What to Verify Next

The origin of the link or message that led to this address should be traced and the sender confirmed through an independent, offline or previously known channel. If a brand, marketplace or creator program is invoked, its official domain should be checked directly through the organisation's own known website, not through this address. Any contact or support details tied to this site should be confirmed through the same independent route. A fresh reputation re-check is warranted only after the operator demonstrates remediation, since current detections stand until then. Evidence:

• Homepage: the suspected-phishing notice means no operator-supplied content is available to cross-check.
• Reputation: the current detections come from multiple independent sources rather than a single flag.

Summary Verdict

The site presents an elevated risk posture. Confirmed adverse reputation and a phishing warning outweigh the technically sound transport security and the absence of observed theft mechanics. The apparent legitimacy of the site is not established, and its operator remains unidentified.

Infrastructure Integrity

The site is fronted by a major CDN and web application firewall, with all observed addresses being edge servers in the US and the real origin not exposed. The TLS certificate is valid from a known issuer. This protection is only a mitigating factor. It reflects the shared platform's hardening and does not offset the external threat detections, and edge-only visibility prevents independent confirmation of where the content is actually hosted.

Closing Assessment

The site should not be used for logins, credential entry, payments or any financial interaction. Any further contact should be limited to non-interactive viewing, preferably in an isolated environment. Anyone who has already submitted information there should change the affected passwords and notify the relevant provider or their security team.