Is Pages a scam? TrustSniffer's high-risk assessment of trumpdynast-presale.pages.dev: 5/100

Security Alert

Fortinet, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

The site is a single-page web property on a free shared-hosting subdomain. Its name presents it as a "presale" for a "Trump dynasty" crypto-style token offering, so its apparent purpose is to solicit early purchases or participation in a tokenised project. When the site was visited by automated analysis, the page returned an access-challenge interstitial titled as a suspected phishing site. Visitors are therefore likely to see a security warning rather than product content, and the offering's mechanics and terms could not be read directly.

Scam/Impersonation Risk

Active contradictions are present, and they are serious. Several independent security vendors currently flag the domain as malicious, including two tier-one vendors, and the domain is blacklisted on external threat-intelligence sources. This is a corroborated reputational finding, not a single-source anomaly. It outweighs every neutral or benign technical trait observed. The hosting-platform challenge page that fronts the site carries a suspected-phishing label, which independently reinforces that assessment. The domain name combines a presale framing with the name of a prominent public figure. That pattern is common in token-presale lures, which exploit topical branding to prompt hurried payments or wallet interactions. No evidence shows any affiliation between the site and the figure it invokes. No conflicting legal identities and no confirmed brand impersonation were found, so the risk rests on the threat listings and the lure pattern. The behavioural sandbox found no wallet-drainer routines, clipboard manipulation, hidden forms or credential posts to external hosts. That reduces the evidence of overt technical exploitation but does not offset the threat listings. Dynamic page content could not be fully observed behind the access gate, so these clean results cover only what was reachable. Evidence:

• The homepage was served behind an access-challenge page returning a forbidden status, with a title identifying it as a suspected phishing site.
• Multiple security vendors, including two tier-one vendors, rate the domain malicious, and a separate external blacklist also lists it.
• Behavioural testing of the homepage across three runs recorded 88 external background requests and 4 external POST submissions, about 97% of external traffic at its peak. All went to destinations classed as known or allow-listed. It also recorded 14 console errors and a DOM change of 1,508 mutations after interaction.
• The domain is about 2.1 years old, with 13 archive snapshots spanning October 2024 to August 2026 (3 years tracked), so the listing attaches to a domain that has been live for some time.

Regulatory Verification Notes

The legal, terms, privacy and about pages could not be assessed because the visitor-facing content was gated, so there is no basis to confirm any operator name, jurisdiction, licence or registration number for a token-sale activity. A token presale would ordinarily be expected to disclose its issuer, offering terms, risk warnings and the regulatory status of the offering, and none of that is verified here. No third-party regulatory or broker-reputation record matched this domain. Its absence is neutral and does not offset the threat findings. The domain is a subdomain on a shared free-hosting platform, which any party can create without corporate vetting. It therefore carries none of the institutional weight of a dedicated, independently registered domain. The site's identity cannot be connected to a real-world brand or person. Evidence:

• The site's transport encryption is a domain-validated certificate issued by WE1, valid to 2026-12-09. This confirms encryption only and says nothing about who operates the site.
• The site is served from AS13335 (Cloudflare, Inc., US), with the shared-platform subdomain as its only domain identity.
• The page title and access gate prevented any review of terms, risk disclosures or issuer details.

What to Verify Next

Any contact with this site should be preceded by independent confirmation of whether the project exists. That means checking the official channels of the public figure or organisation the name invokes, and not any link or social handle supplied by the site itself. If the offering claims to be a regulated securities or token sale, the claimed issuer and its authorisation should be checked directly with the relevant financial regulator's own register. The official support and contact channels should be confirmed through an independent route. Any smart-contract address or payment instruction should be cross-checked against a project source known to be authentic before value is moved. Evidence:

• The homepage presents a "presale" offering whose issuer and terms could not be read.
• No regulator or broker-database record matched the domain.
• Several vendors and an external blacklist currently list the domain as malicious.

Summary Verdict

The assessment is a critical, high-risk posture. Corroborated, current threat listings from multiple independent sources are decisive, and the presale framing is consistent with a known fraud pattern. Nothing in the technical or historical profile offsets this, and identity and legitimacy remain unestablished.

Infrastructure Integrity

The site is fronted by Cloudflare's CDN and web application firewall. All four observed addresses are edge servers, and the true origin host is not observable. This shields the site from direct probing and signals competent hosting. It is only a mitigating factor, and it does not prove legitimacy. The same edge-only visibility prevents independent verification of where the content actually resides and allows content to be swapped without notice.

Closing Assessment

The site should not be used for sign-in, wallet connection, credential entry or any payment or token purchase. At most, it should be viewed passively from an isolated environment, and no files or links from it should be opened. Anyone who has already interacted with it should stop further contact. They should revoke any wallet approvals, change reused passwords, and report the domain to the hosting platform and the relevant fraud authority.