Is telcoins-bank-net.pages.dev a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website sits on a free, shared hosting subdomain of a developer-pages platform. Its hostname is styled like a telecom-token banking portal, with the words "telcoins", "bank" and "net" chained together. When the site was captured, the visitor-facing page was a security interstitial titled as a suspected-phishing warning rather than a normal homepage. Only a very small amount of text was retrievable, so the site's apparent purpose is an online banking or crypto-account portal presented under a brand-style name, and that purpose could not be confirmed from its own content.

Scam/Impersonation Risk

This is a confirmed adverse-reputation case, and the report treats it as high risk. The domain is blacklisted: a large cluster of independent security engines currently classifies it as malicious. These include several tier-one endpoint-security vendors, and the volume of detections is enough on its own to trigger an automatic critical-risk override. Automated capture of the homepage was answered with an access challenge, and the page that rendered carried a suspected-phishing warning title. That corroborates the external detections rather than contradicting them. The hostname format is also a recognised lure pattern. A banking-style brand string is appended to a free subdomain of a shared hosting platform, which gives the operator no verifiable brand ownership of the namespace. No conflicting legal entities were found, because there was no legal or identity content to compare. Behavioural testing found no wallet-drainer activity, clipboard manipulation, hidden forms or credential posts to outside parties. Those clean results do not offset the detections, because the page may serve different content to real users than it did to automated sessions. Evidence:

• Homepage capture: the page was blocked by a bot challenge, and the captured document was titled as a suspected-phishing warning.
• Reputation layer: eleven engines rated the domain malicious and one rated it suspicious, including three tier-one vendors, which triggered the critical blacklist override.
• Behavioural sandbox: about 95% of observed network activity was directed to external hosts, with 21 external XHR/fetch calls, 5 external POST requests and 16 console errors across three runs.
• Behavioural sandbox: no wallet connection attempts, clipboard writes, hidden forms or external password forms were detected.

Regulatory Verification Notes

No licence, registration number, legal entity name or physical address could be extracted. The only retrievable content was the platform's warning interstitial. This is a content gap and is not treated as proof of fraud, but here it compounds the confirmed threat detections instead of standing alone. Operator ownership is opaque, and the real-world identity behind the site could not be independently connected to any brand or person. The name "bank" implies a regulated activity, yet no supervisory authority, deposit protection or regulated status is evidenced. No third-party broker-reputation record matched this domain, so there is no external regulatory context to weigh. The site's valid transport encryption confirms only an encrypted connection and says nothing about the operator's honesty. Evidence:

• Legal and identity pages: none were retrievable, and no regulator, licence or company details appeared in the captured content.
• Hosting: served from AS13335 (Cloudflare, Inc., US) on shared platform infrastructure.
• Transport security: TLS certificate issued by WE1, domain-validated (DV) only, valid to 2026-12-05 (39 days remaining).
• Broker-reputation lookup: no match for this domain.

What to Verify Next

Any dealing with an organisation behind this name should start from independent, known-good channels. The relevant brand's official website should be reached through a fresh search or a pre-existing bookmark, never through this hostname or a link that leads to it. If the brand claims a regulated banking or payments status, that status should be confirmed directly in the supervisory register of its home jurisdiction. The organisation's official support channels should be confirmed through an offline or independently sourced route. Anyone who has already visited the site and entered any details should rotate those credentials and monitor the associated accounts. Reporting the hostname to the hosting platform's abuse desk is also appropriate. Evidence:

• Hostname: a banking-style brand string on a free shared subdomain, with no brand-owned top-level domain.
• Homepage: the captured page showed a security warning and no identifiable operator, contact or product information.
• External reputation: current malicious classifications from multiple independent engines.

Summary Verdict

The available evidence places this website in the critical-risk tier. Strong, current, multi-source threat detections dominate the assessment, and the technical hygiene that is present carries no weight against them. The operator's identity is unestablished, and the site cannot be regarded as a legitimate financial or banking service on the present record.

Infrastructure Integrity

The site is fronted by Cloudflare's CDN and WAF. All four observed addresses are edge servers, and no origin address could be observed, so the real hosting location cannot be independently checked. Edge-only visibility can also make it easier to swap content quickly without a visible change in hosting. Cloudflare's protections and a trusted network provider are mitigating factors only. They do not reduce the reputational risk from the confirmed detections, and they say nothing about the operator's intent.

Closing Assessment

Treat this site as unsafe for any login, credential entry, payment or financial interaction, and avoid downloading anything from it. If contact is necessary, limit it to passive viewing in an isolated environment. Anyone who has already interacted with it should change affected passwords and alert their financial institution.