Is solvprotocolverification.pages.dev a scam? TrustSniffer's high-risk assessment: 5/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This is a web page hosted on a free subdomain of a developer hosting platform, under a name that suggests a verification or onboarding service for a crypto asset protocol. The automated capture returned only a short interstitial notice, so no product pages, company description or service offering could be read. The name implies a verification step that a visitor would complete before accessing a protocol or its assets, which is a common lure format. The site's business model and purpose could not be established from its own content.

Scam/Impersonation Risk: Contradictory signals are present and sufficient to treat this site as high-risk. Several independent detection engines currently flag the domain as malicious, including three tier-one security vendors. A confirmed blacklist listing exists, and it triggered the strictest reputation cap available. When the site was visited, the hosting platform's own security layer served an interstitial titled as a suspected phishing warning instead of the site's content. That page carries no identifying content, so the reason for the flag cannot be read from it. Nothing was observed to refute the warning. The domain label combines a protocol brand with the word "verification", a pattern commonly used to make credential or wallet-approval requests look official. It closely resembles its parent hosting domain, which adds a lookalike dimension. No conflicting legal entity names were observed, because no legal pages were captured. Behavioral testing recorded heavy outbound traffic: about nine in ten recorded network requests went to external destinations, including outbound data submissions. All of these went to recognized, whitelisted services, and no wallet-drainer, clipboard-hijack or hidden-form behavior was detected. This lowers the likelihood of automated theft mechanics but does not offset the external detections. Evidence:

Regulatory Verification Notes: No regulatory registration, licence or supervisory listing is evidenced for this site, and no third-party broker or regulator match was found. Because no legal, about or terms page could be read, the operator's real-world identity is not independently verified and cannot be connected to any named entity. Operator ownership is opaque. This is an identity limitation and not a contradiction in itself. The decisive concern here is the active threat listing, not any licensing gap. Any claim of official affiliation with a named protocol should be treated as unsubstantiated. Evidence:

What to Verify Next: The protocol this domain appears to reference should be contacted only through its officially published website, documentation or verified social accounts, entered manually or from a trusted bookmark. That route should confirm whether any "verification" step exists. If a message, advertisement or direct message supplied this address, its sender should be authenticated through an independent route, and the message should be reported as a suspected phishing lure. Organizations should check internal logs for any prior access to this domain. Anyone who has already interacted with it should review and revoke wallet approvals and change any reused credentials. The domain owner or hosting platform can be notified so the listing can be reviewed. Evidence:

Summary Verdict: The overall posture is clearly cautionary and high-risk. Convergent threat detections, a confirmed blacklisting, a platform-level phishing warning and a lure-style domain name outweigh the technically valid encryption and the site's short but continuous history. Real-world operator identity remains unverified, and nothing in the evidence supports legitimacy.

Infrastructure Integrity: The site is fronted by Cloudflare's CDN and WAF, and all four observed addresses are edge nodes on the same network, so the origin server was not observable. Bot-challenge protection was active during testing. This is a mitigating factor only, because the same platform is widely used by legitimate and malicious sites alike. It cannot offset the external threat listings and also prevents independent hosting verification.

Closing Assessment: Interaction with this site should be avoided. No login details, seed phrases, wallet connections, approvals or payments should be given to it, and nothing should be downloaded from it. Any contact with the site should be limited to passive viewing from an isolated environment, and suspected phishing use should be reported.

• Homepage: the hosting platform's security layer served a "suspected phishing" interstitial instead of site content.
• Reputation checks: 11 engines flagged the domain as malicious and 2 as suspicious, including the three tier-one vendors, and a confirmed blacklist listing is active.
• Domain registration: the domain is about 2.1 years old.
• Web archive: 9 snapshots from 2024-09 to 2025-03 (2 years tracked), with no content drift.
• Homepage: only a very short block of text was readable, with no company name, address or registration details.
• Network hosting: served from AS13335 (Cloudflare, Inc., US).
• Transport encryption: TLS certificate issued by WE1 at DV level, valid to 2027-01-15, with 80 days remaining.
• Homepage: no legitimate verification flow could be observed.
• Reputation checks: the active blacklist listing and detections are the basis for treating prior interactions as potentially exposed.
• Domain label: the naming pattern pairs a protocol brand with "verification" on a free hosting subdomain.