Is tg-hermesworlds-com.pages.dev safe? TrustSniffer's low-trust assessment: 38/100

Overview

HermesWorld is a browser-based 3D multiplayer online game ("Browser 3D MMO with AI Agents") served from a free-tier shared-hosting subdomain rather than a branded domain of its own. A visitor lands on a single text-rich page of roughly six thousand characters that presents the game and its AI-agent theme. The apparent purpose is to attract players to a web game, but the hosting pattern and the external threat listing mean it cannot be treated as an established or independently attributable operator.

Scam/Impersonation Risk

The assessment is clearly cautionary. An external reputation source currently lists the site as malicious and suspicious, which makes this a confirmed blacklist hit and the decisive risk factor. The hostname is a disposable subdomain on a shared hosting platform. Its label embeds a ".com"-style string ("hermesworlds-com") and a short prefix, which imitates a standalone domain and is a pattern commonly used to pose as a brand's official presence. No conflicting legal entities or confirmed brand impersonation were observed. The listing and the hostname construction are the contradictory signals, and they are enough to treat any claim that this is an official HermesWorld property as unsupported. Behavioral testing found no wallet-connection prompts, clipboard manipulation, hidden forms, cloaking, or external password forms. However, the homepage generated a high volume of outbound background requests, including several data submissions to third-party destinations outside the site's expected service set. It also produced repeated client-side script errors. A game landing page has little legitimate need for that much outbound posting, so the traffic is a meaningful secondary concern. Evidence:

• Homepage: an external reputation check returned one malicious and one suspicious detection, and this drives the confirmed blacklist finding.
• Hostname: the site runs on a free shared-hosting subdomain whose label mimics a dotted domain name, not on a registered brand domain.
• Homepage behavior: 9 outbound XHR/fetch calls and 6 outbound POST requests were observed, all 6 POSTs to non-whitelisted destinations, along with 10 console errors across 3 successful test runs.
• Homepage behavior: no wallet-drainer, clipboard-hijack, hidden-form, or cloaking activity was detected.

Regulatory Verification Notes

The site presents no verifiable corporate identity, licensing status, or registration details that connect it to a real-world operator. The sampled homepage content did not allow the operator to be independently tied to any named company or person. Disclosure on the page remains unclear, and no third-party broker or regulatory-database record matched the site. That absence of a match is neutral. It neither confirms nor refutes legitimacy, and the elevated risk rests on the threat listing rather than on missing paperwork. The site uses a valid certificate from a recognised issuer. This confirms an encrypted connection only and says nothing about who operates the site. Evidence:

• Hosting: served from AS13335 (Cloudflare, Inc., US).
• Transport security: TLS certificate issued by WE1 at domain-validated (DV) level, valid to 2027-01-11, with about 80 days remaining at analysis.
• Homepage: the page title identifies a "Browser 3D MMO with AI Agents", but no operator, company, or licensing information is tied to it.
• Broker intelligence: no matching third-party broker record exists.

What to Verify Next

Before any engagement, confirm through an independent route that HermesWorld has an official web presence, and whether this subdomain is linked from it. If an official site exists, compare its address character by character with this host. Official social profiles or an app-store listing, reached from the official source and not from a link supplied by this site, can also establish where legitimate downloads and accounts live. Check whether the threat-intelligence listing has been cleared on a later date. Any account creation, in-game purchase, or payment request on this host should be treated as unverified until the operator is confirmed. Also confirm the official support and contact channels through the same independent route. Evidence:

• Hostname: the shared-hosting subdomain gives no standalone brand registration to check against.
• Reputation: the threat listing was current at the time of analysis and should be re-checked before any decision.
• Homepage: the game and AI-agent claims are not backed by an identifiable publisher.

Summary Verdict

The site carries an elevated-risk posture. Active external threat detections outweigh the otherwise sound technical hygiene and the absence of overt credential-harvesting mechanics. Apparent legitimacy cannot be established, and the operator's identity remains unverified. The decisive factor is the confirmed blacklist hit, which makes this a high-risk site for sensitive interaction.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and WAF, and every observed address is a CDN edge address. The origin server was not observable, so the real hosting location cannot be independently checked. This is a mitigating factor for availability and basic protection only. It does not offset the external reputation risk and is not evidence of legitimacy. Edge-only visibility also means content can be changed quickly without any visible change in hosting.

Closing Assessment

Interaction should be limited to passive, read-only viewing at most. Accounts, credentials, wallet connections, downloads, and payments should be avoided on this host until the threat listing is cleared and the operator is confirmed through an official, independently reached channel.