Is sentioai.pages.dev a scam? TrustSniffer's high-risk assessment: 5/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a project hosted on a shared, platform-provided subdomain, presenting itself under the name "Sentio AI". When it was assessed, the visitor-facing page was a platform interstitial titled as a suspected misleading website, not substantive product or company content. The apparent purpose and business model therefore cannot be confirmed from the site's own pages, and the site is assessed as a high-risk web property of unconfirmed purpose.

Scam/Impersonation Risk

Material contradictory signals are present. Several major security vendors independently flag the site as malicious, and the aggregate detection level is strong enough that the site is treated as blacklisted. This is a decisive negative that outweighs every neutral or favourable technical attribute. The hostname also closely resembles its parent platform domain, which is a recognised pattern in lookalike and misleading-site hosting. The platform's own warning page reinforces the third-party detections. The sandboxed behavioural runs showed no wallet-connection prompts, clipboard manipulation, hidden forms, credential posts to external hosts, or cloaking. Heavy outbound traffic went to recognised destinations, and the console showed recurring script errors. These findings mean no active drainer mechanics were observed in the sandbox. They do not offset the external detections, because malicious behaviour can be gated, delayed or swapped after capture. No conflicting legal identities, brand-impersonation claims or phishing-form findings were established in the captured content. Evidence:

• Homepage: the captured page was a platform warning interstitial labelled as a suspected misleading website, and the response was blocked with an access-denied status.
• Reputation: 11 malicious and 1 suspicious detections were returned across the security-vendor set, including three tier-one vendors, which triggered the automatic critical cap.
• Homepage behaviour: 128 external background requests and 7 external POSTs across three runs, all to recognised destinations, with 12 console errors and no wallet, clipboard, hidden-form or cloaking activity.
• Domain: a registered-domain lookalike similarity to its parent platform domain was recorded, and the web archive holds only 6 snapshots spanning 2025–2026 (about 2 years tracked).

Regulatory Verification Notes

The captured content contained no legal, terms, privacy or about page, so no company name, jurisdiction, licence or registration number could be assessed, and no regulated status is established. This is a disclosure gap, not evidence of wrongdoing in itself. Operator ownership is opaque. This is an ownership-opacity limitation, not an identity contradiction. The domain is a subdomain of a shared hosting platform, so registration details describe the platform and not the operator. No broker-reputation match exists for this name, so there is no third-party regulatory context either way. Real-world operator identity remains unconnected to any verified brand or person. Evidence:

• Domain provenance: the domain is about 1.8 years old (first observed in the archive in January 2025, last in August 2026).
• Hosting: served from AS13335 (Cloudflare, Inc., US, ARIN registry).
• Transport security: the TLS certificate was issued by WE1 as a domain-validated certificate, valid to 2027-01-22. This confirms encrypted transport only, not operator identity.
• Terms/about/contact pages: no legal-entity or licensing information was available in the captured content.

What to Verify Next

Any engagement should first be preceded by independent confirmation that the site is not the subject of an active security listing. This means re-checking the current status with the listing vendors and with the hosting platform's abuse team. If the site claims association with any company, that company's identity and its official web address should be confirmed through an independent, offline route, since the on-site claims cannot be relied on. Any regulatory status claimed must be checked directly in the relevant public registry. Official support and contact channels should be confirmed independently before any message is sent. Evidence:

• Homepage: the interstitial and the vendor detections remain the only substantive observations, so they should be re-tested on a later date.
• Archive: with only 6 snapshots over about 2 years, no long, stable record is available to confirm historical legitimate use.
• Behavioural runs: external traffic accounted for up to 96.2% of observed network activity on the page, which warrants re-examination if the site's status changes.

Summary Verdict

The overall posture is high risk. Convergent third-party threat detections, together with a platform-level warning on the homepage and unverified operator identity, outweigh the site's technically orderly attributes and its clean sandbox behaviour. The evidence is consistent with a site that should be treated as unsafe for any sensitive interaction until its reputation is independently cleared.

Infrastructure Integrity

The site is served through Cloudflare's CDN and WAF (AS13335, United States). All four observed addresses are CDN edge servers and no origin address was observable. The DNS record lifetimes are short, which is common for CDN-fronted sites. This is a mitigating factor for transport and availability only. It confirms nothing about the operator, and it cannot offset the external threat detections, since the same edge layer also prevents independent hosting verification and can mask rapid content changes.

Closing Assessment

Treat the site as read-only at most, and avoid sign-in, entering credentials, connecting wallets, making payments or downloading files from it. Reassess only if the threat listings are independently cleared and a verifiable operator identity is established.