Is tg-podthesquire-com.pages.dev a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This is a web page served from a free developer-hosting subdomain. Its hostname is a hyphenated string that imitates a conventional domain name, and the name also carries a messaging-brand prefix. The only content captured was a security interstitial titled as a suspected-phishing warning, so no genuine storefront, service or product page was observed. The apparent purpose is a disposable landing page of the kind commonly used to lure visitors toward credential or account-takeover flows. The site's actual business model could not be established.

Scam/Impersonation Risk

The evidence shows an elevated, security-relevant threat profile. The site is currently blacklisted by external threat-intelligence sources. Multiple independent security engines classify it as malicious, and two top-tier security vendors are among those flagging it. The page captured from the site's root was a protective challenge page labelled as suspected phishing, which reinforces this reputational signal. That interstitial is a third-party platform warning, not a confirmed finding of impersonation of a specific brand. The hostname's structure resembles a repurposed dotted domain with a messaging-brand prefix, a pattern typical of lookalike campaigns. It sits on a shared subdomain space that offers no brand-owned domain authority. Automated behavioural testing found no wallet-connection prompts, clipboard manipulation, hidden forms or credential posts to external parties. This does not offset the blacklisting, because the actual page content was gated behind a bot challenge and the interactive surface was never fully exposed. The site's scripts also produced a high volume of console errors, and nearly all observed network activity was directed to external hosts. That is consistent with a thin shell that loads its substance from elsewhere. No conflicting legal identities were observed. Evidence:

• Homepage: the captured page title read as a suspected-phishing warning and the request returned an access-denied status behind a bot challenge.
• External reputation: eight security engines rated the site malicious and two suspicious, including two tier-one vendors, and a blacklist hit was confirmed.
• Behavioural sandbox: 17 console errors across three runs, with about 95% of observed network activity directed to external hosts.
• Hostname: a hyphenated, lookalike-style name on a shared hosting subdomain, with no independent brand domain.

Regulatory Verification Notes

The captured page exposed no legal, terms, privacy or about content. No operator name, licensing statement or registration reference could therefore be assessed, and the real-world identity behind the site remains unconnected to any known brand or person. No third-party broker or regulatory-database match was found, so no regulated status can be attributed. The valid transport-encryption certificate is a baseline hygiene item. Free domain-validated certificates are issued to benign and malicious sites alike, so it does not indicate legitimacy. Evidence:

• Homepage: only a short interstitial of roughly 381 characters of text was captured, with no legal or identity pages reachable.
• Transport encryption: the TLS certificate was issued by WE1 at domain-validated (DV) level and is valid to 2027-01-01.
• Third-party broker lookup: no matching entity was found.

What to Verify Next

Any claim that this page belongs to a known brand or service should be checked against that organisation's official channels, reached through a trusted bookmark or an independently sourced address. If the page arrived by message, email or social media, the sender should be contacted through a separate route to confirm they sent it. A security team assessing exposure should review whether any users have already visited it or entered data, and should check proxy and DNS logs for the hostname. Any organisation that believes its brand is being imitated should report the page to the hosting platform's abuse process. Evidence:

• Homepage: the platform-issued phishing warning is the first point to confirm with the hosting provider.
• Reputation findings: the multi-engine detections identify which security vendors can be consulted for re-analysis.
• Hostname: the shared-subdomain structure means takedown requests go through the hosting platform, not a standalone registrant.

Summary Verdict

The overall posture is high risk. Confirmed external threat listings are the decisive factor, and the page's own phishing warning corroborates them. Technical hygiene signals, such as a valid certificate and an identified network provider, carry no weight against that reputational evidence. The operator's identity and purpose remain unestablished.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and WAF, served from AS13335 (Cloudflare, Inc., US). All four observed addresses are edge nodes, and no origin server was observable. This protection mitigates availability and exposure concerns only. It also prevents independent hosting verification, so it cannot offset the external threat listings or vouch for the content behind the edge.

Closing Assessment

The site should not be used for login, credential entry, wallet connection, downloads or any payment or financial activity. Anyone who has already submitted information should change the affected passwords from a clean device and monitor the relevant accounts. Organisations should block or sandbox the hostname and report it to the hosting platform.