Is smartapp-verify.pages.dev a scam? TrustSniffer's high-risk assessment: 5/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a single-page crypto-themed site served from a generic hosting subdomain under pages.dev. Its homepage is titled as a "Cross-Chain Router Protocol" under the Multichain name, and its hostname adds a "verify" and "smartapp" framing. It presents itself as a cross-chain asset-routing service. Its apparent purpose is to draw visitors into a blockchain bridging or wallet-verification flow under a borrowed protocol identity.

Scam/Impersonation Risk

Confirmed adverse reputation contradictions are present. The domain is blacklisted by multiple independent reputation sources, and a large number of security engines classify it as malicious. These include several of the best-known endpoint-security vendors. This is the decisive finding and is not offset by any technical hygiene signal. The content-level risk compounds it. The homepage trades under the name of a cross-chain router protocol, but the address is an unrelated generic subdomain whose "smartapp-verify" label reads as a lure to verify or connect. No evidence links the site to the genuine protocol brand. Sites that borrow a bridging-protocol identity are a common vehicle for wallet-approval and credential-capture schemes. The sandbox did not observe a wallet-drainer, clipboard-hijack, hidden-form or cloaking behaviour. That absence is a limit of three observed sessions, not a clearance, and it does not outweigh the blacklist convergence. The page makes a heavy volume of third-party calls, including form-style submissions to external destinations and repeated front-end script errors. Together these are consistent with an unstable or hastily assembled page. No two conflicting legal entities appear, so this is not an identity contradiction. The risk comes from the reputation and brand-borrowing signals alone. Evidence:

• Homepage title presents the site as a cross-chain router protocol under the Multichain name, while the hostname is an unrelated pages.dev subdomain.
• Domain continuity of roughly 1.8 years. The web archive holds only 5 snapshots, from 2024-12-29 to 2025-02-27 (2 years tracked), and the archive record itself carries a known-phishing marker.
• Sandbox observed 108 external fetch/XHR requests and 9 external POSTs across 3 runs, with 12 console errors. No wallet-connect, drainer, clipboard-write or cloaking behaviour was detected.

Regulatory Verification Notes

The captured homepage supplies no legal entity name, licence, registration number or accountable operator. The identity of whoever runs the site is therefore not independently established, and no regulatory standing can be attributed to it. No third-party broker or regulator database match was found, so there is no outside reputational signal either way on its claimed activity. For a site that appears to offer cross-chain routing, which is a financial-adjacent function, this absence of any accountable party is material. It is not evidence of wrongdoing on its own. The adverse reputation findings above are what drive the elevated assessment. Evidence:

• Homepage content yields no company name, licence reference or jurisdiction.
• Hosting network AS13335 (Cloudflare, Inc., US); TLS certificate issued by WE1 (DV, domain-validated only), valid to 2027-01-09. This confirms encryption but says nothing about operator identity.
• Domain age and archive depth (about 1.8 years, 5 snapshots) are too shallow to establish a track record.

What to Verify Next

Do not interact with this address until its connection to the genuine protocol is confirmed through an independent route. Confirm the protocol's official domain and communication channels from sources reached without using this site, such as its established documentation or verified social accounts. Compare them against this address. Any wallet-connection prompt, signature request or "verification" step presented here should be treated as unauthorised until that link is proven. Any wallet already used on this site should have its token approvals reviewed and revoked. Anyone who has already interacted with the site should consider moving remaining assets to a fresh wallet. The operator's licensing claims, if any exist, should be checked directly with the relevant financial registry. The site should be reported to the hosting platform's abuse process and to the relevant anti-phishing channels. Evidence:

• Homepage presents a protocol-branded interface that the sandbox could not link to any official brand property.
• Reputation findings from several independent sources are current, so any prior assumption of safety should be discarded.
• The hostname's "verify" wording is consistent with a prompt to authorise or connect, which warrants wallet-approval review after any contact.

Summary Verdict

The assessment is a high-risk posture. Independent adverse reputation findings converge with a brand-borrowing presentation and an unestablished operator. Technical hygiene on the site does not mitigate this. Apparent legitimacy cannot be inferred, and the identity of the site's operator remains unverified.

Infrastructure Integrity

The site is served entirely through Cloudflare's CDN/WAF, and all observed addresses are edge servers. The origin host could not be observed, so the true hosting location cannot be independently checked, and content can change quickly behind the edge. The valid domain-validated certificate and trusted CDN are mitigating, not exculpatory. They show only that the connection is encrypted and routed through a mainstream provider. They do not offset the reputation findings.

Closing Assessment

Treat the site as unsafe for any login, credential entry, wallet connection, signing or financial transaction. At most, view it passively, and use only the protocol's officially published channels for any real activity.