Is scarquest-whitelist.pages.dev safe? TrustSniffer's moderate-trust assessment: 60/100

Overview

This is a project-style web property on a free, shared Cloudflare Pages subdomain. Its name, "scarquest-whitelist", suggests a whitelist or early-access sign-up page for a venture called Scarquest. The captured evidence shows no readable product, pricing or company content on the homepage, so its apparent purpose is limited to the allowlist-style sign-up implied by that name.

Scam/Impersonation Risk

This is the decisive area of the assessment. The domain is blacklisted. Several independent threat-intelligence engines currently classify it as malicious or suspicious, and an external blacklist record corroborates this. Reputation data also carries a phishing-association indicator for the domain. "Whitelist" pages are a common lure format for token-allocation and wallet-connection scams, and a free subdomain on a shared platform costs an operator nothing to create and abandon. Sensitive interactions are therefore treated as unsafe, and any prompt to log in, enter credentials, connect a wallet or send funds would be a serious red flag. No conflicting legal entities or brand impersonation were observed, because no identity pages with named companies could be examined. Browser-behaviour testing was largely benign. Three clean runs showed no wallet-drainer activity, clipboard manipulation, hidden or external password forms, or content cloaking, which limits the immediate technical exposure. The reputation signals still outweigh this, and a clean test run does not rule out content changes later. Ownership opacity also applies, since the operator cannot be tied to any real-world person or organisation. Evidence:

• Homepage and reputation records: three engines rate the domain malicious and one suspicious, and a separate external blacklist also lists it.
• Domain continuity: first recorded 2024-12-07, about 1.9 years old, with 8 archive snapshots spanning 2024–2025 (2 years tracked) and no content drift between captures.
• Behavioural sandbox on the homepage: 3 of 3 runs completed with no wallet-connect, clipboard-write, hidden-form or cloaking activity, but 13 console errors were logged.
• Identity: no named operator, brand or legal entity could be linked to the site.

Regulatory Verification Notes

The evidence contains no legal or identity pages (terms, privacy policy, about page), no company name, and no licence or registration reference. For a site whose name implies a token or allocation scheme, that leaves no regulated counterparty to hold accountable. No third-party broker or regulatory database lists the site. Nothing here indicates the site is licensed or supervised, and the absence of disclosure is a verification gap, not proof of wrongdoing in itself. The security-relevant conclusions rest on the reputation findings above. Evidence:

• Homepage: no legal-entity name, licence number or registered address is presented.
• Regulatory sources: no regulator or broker-reputation match was found for the name.
• Hosting: served from AS13335 (Cloudflare, Inc., US).
• Transport encryption: TLS certificate issued by WE1 (DV, domain validation only), valid to 2026-12-17. DV confirms control of the domain, not the operator's identity.

What to Verify Next

Any claim of an official Scarquest project should be traced to a primary source independent of this page, such as a project domain linked from established channels. That would show whether this subdomain is an official property or an imitation. If the site claims regulated activity, the named entity and licence should be confirmed directly in the relevant regulator's public register. Any official support or contact channel should be confirmed through an independent route and not through links on this site. The domain's reputation status should be re-checked before any decision, since a compromised or repurposed property can be cleaned or re-flagged quickly. Evidence:

• Homepage: no named entity or licence that could be checked in a registry.
• Domain: a shared-platform subdomain, so its existence does not imply any particular organisation controls it.
• Reputation records: the current malicious and suspicious classifications are the baseline against which any re-check should be compared.

Summary Verdict

The site is a young, low-footprint property with an unidentifiable operator and active, multi-source adverse reputation findings. Those findings dominate over the benign technical hygiene and calm sandbox behaviour. The overall posture is elevated risk, appropriate only for passive observation and not for sensitive or financial interaction.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and WAF, and all observed addresses are edge servers, with no origin server visible. This protective layer is a mitigating factor only. It shields the underlying host from direct exposure but does not vouch for the content or operator, and edge-only visibility also prevents independent verification of the true hosting and makes rapid content swaps harder to detect. The valid certificate from a recognised issuer shows basic transport security hygiene and nothing more.

Closing Assessment

Interaction should be limited to passive viewing. Credentials, wallet connections, personal documents and payments should not be submitted, and nothing should be downloaded or signed until the domain's status is independently reconciled with an official source.