Is uni-swap-live.pages.dev a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Google, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website sits on a free shared-hosting subdomain and uses a name built to read like a decentralized-exchange swap portal ("uni-swap-live"). Visitors who reach it are met by a hosting-platform interstitial reading "Suspected Phishing" rather than any site content. Its apparent purpose is to draw visitors into a crypto-swap or wallet-related interaction under a familiar brand-style name. The security checks below show it is currently treated as a social-engineering site.

Scam/Impersonation Risk

The evidence converges on an elevated, confirmed-threat posture. The site is blacklisted by a major browser-protection service, which classifies it as social engineering. A broad group of independent security engines also flag it as malicious, including several top-tier vendors, and a further engine rates it suspicious. Together these listings trigger the strongest class of external contradiction. The hosting platform's own challenge page carries a "Suspected Phishing" title, so the platform has independently flagged the content and blocked automated capture with an access-denied response. The domain name pairs a well-known exchange-style word with "live" on a throwaway subdomain. That pattern is typical of lookalike lures aimed at users of decentralized trading tools. No conflicting legal identities were observed, and no explicit brand-impersonation finding was recorded. The case rests on the threat listings. Behavioral testing over three runs found no wallet-connection attempts, clipboard manipulation, hidden forms or external password forms. That testing could not reach the real page behind the challenge, so it does not offset the listings. Most outbound requests went to third-party destinations, and the pages produced a high number of console errors. Evidence:

• Homepage capture returned an access-denied response from a bot challenge titled "Suspected Phishing", so no site content or product claims could be read.
• The browser-protection service flags the domain as social engineering. 11 security engines rate it malicious and 1 suspicious, against 49 harmless and 31 undetected.
• Behavioral sandbox runs recorded 14 console errors, 20 external XHR/fetch calls, 4 external POSTs and a high share of external traffic. No requests to non-whitelisted destinations were seen.
• Behavioral runs detected no wallet-drainer activity and no clipboard writes. The challenge page limited what could be observed.

Regulatory Verification Notes

No licence, registration number, legal entity name or terms page could be retrieved, because the only page captured was a platform security interstitial. The site is a subdomain of a shared hosting platform, so it has no standalone registrant record to anchor an operator identity. Operator and ownership opacity is therefore present. Real-world identity could not be tied to any brand or person, and no third-party regulatory or broker record matched the name. The domain is also not recognised in any public DeFi protocol directory. This means no independent reputation supports the exchange-style naming. These points are verification gaps. The threat listings above, not the missing disclosures, drive the risk assessment. Evidence:

• The homepage returned only a platform challenge page, so no legal, terms, about or licensing pages were available.
• The site is served from AS13335 (Cloudflare, Inc., US, ARIN registry).
• The TLS certificate is a domain-validated (DV) certificate issued by WE1, valid to 2027-01-13 (79 days remaining). DV validation confirms domain control only, not operator identity.
• The domain is not listed in a public DeFi protocol directory.

What to Verify Next

Treat the domain as unverified until proven otherwise. Any official swap or exchange the name appears to evoke should be reached only through bookmarks or addresses the user typed in from a trusted offline source, never through links received in messages or search adverts. Anyone who already visited the site should check whether any wallet connections or token approvals were granted and revoke them through a wallet-approval checker. Users should also confirm that no seed phrase, password or signature request was submitted. The reported listings should be re-checked with the security vendors and the hosting platform to see whether the flag has been cleared or the content taken down. Organisations should confirm official support and contact channels through an independent route. Evidence:

• The browser-protection listing and the platform's "Suspected Phishing" interstitial were both observed on the homepage.
• No operator, legal entity or licensing information was exposed on any captured page.
• The challenge-page capture produced no verifiable contact channels.

Summary Verdict

The overall posture is high risk. Multiple independent, authoritative threat sources agree that the site is a social-engineering threat, and no positive trust signal can offset that. Identity and operator legitimacy remain unestablished.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and WAF, and all four observed edge addresses (two IPv4, two IPv6) belong to that provider. A valid TLS certificate from a recognised issuer is in place. The origin server was not observable, so hosting could not be independently attributed. This is a mitigating technical factor only. It does not cancel the confirmed reputation risk, and shared protective infrastructure is equally available to malicious pages, so it carries no weight as evidence of legitimacy.

Closing Assessment

The site should be treated as unsafe for any interaction beyond passive viewing. That means no wallet connections, no signing, no credential entry, no payments and no downloads. Anyone who has already interacted with it should act on the remediation steps above immediately.