Is vtyvv.pages.dev a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a project hosted on a free, shared subdomain of a developer web-publishing platform. Its content could not be seen as intended: automated access returned a protective interstitial page, titled as a suspected-phishing warning, with only a few hundred characters of text and no identifiable brand, product or service. Its apparent purpose cannot be established from what was presented, but it is currently flagged by multiple independent security sources as malicious.

Scam/Impersonation Risk

Contradictory signals are present and are the decisive factor in this assessment. The domain is confirmed as blacklisted by external threat-intelligence sources, and several independent security engines classify it as malicious, including two major security vendors. Further engines rate it suspicious. The page returned to the analysis sensor was itself a phishing-warning interstitial, which corroborates these detections rather than contradicting them. No brand impersonation or conflicting legal identities were observed, because no identity or legal pages were available to compare. Behavioural testing found no wallet-connection prompts, clipboard manipulation, hidden forms or credential posts to external destinations. These clean results do not offset the reputation findings. The site did load a very high proportion of its content from external origins, made repeated external background requests and submissions, produced repeated script errors, and rewrote a large share of the page structure after interaction. That pattern is consistent with content that changes after load, which suits staged phishing or redirection and cannot be reviewed from a static snapshot. Evidence:

• Homepage: the page served to the sensor was a protective interstitial titled as a suspected-phishing warning, and the capture was blocked with an access-denied response.
• External reputation: seven security engines flag the domain as malicious and two as suspicious, with an external blacklist hit confirmed.
• Homepage behaviour across three test runs: 50 external background requests, 5 external submissions, 12 console errors and about 1,500 page-structure mutations after interaction.
• Behavioural testing found no wallet-connect, clipboard-write or hidden-form activity.

Regulatory Verification Notes

No legal, terms, privacy, about or contact pages could be reviewed, so there is no on-site company name, licence, registration number or regulator reference to assess. A shared platform subdomain also gives no independent corporate anchor. The lack of regulatory information is a verification gap, not proof of wrongdoing. Here, however, it comes with confirmed threat detections, so no claim of authorisation or licensing could be accepted without independent proof. The third-party broker dataset returned no match for this domain, which means only that no broker-reputation signal exists. It is not a regulatory clearance. Technical hygiene is unremarkable and does not mitigate the reputation findings. Evidence:

• Hosting: served from AS13335 (Cloudflare, Inc., US).
• Transport encryption: TLS certificate issued by WE1 (DV, domain-validated only), valid to 2027-01-01; it proves encryption, not operator identity.
• Homepage: no legal-entity name, licence or registry reference was visible in the content captured.

What to Verify Next

Any reference to this site received through a message, advertisement or social channel should be traced back to its sender and checked through an independent, offline route. If the site claims to represent a company, that company's official domain should be obtained from a registry or from a source unconnected to this link, and the two compared. Any licence or registration claim should be checked directly with the relevant regulator's public register, not through details the site supplies. Official support channels should likewise be confirmed independently. If the domain was reached through an unsolicited link, the message should be reported to the platform or mailbox provider that delivered it. Evidence:

• Homepage: no operator identity was presented that could be cross-checked.
• Reputation: independent detections remain active against this domain.
• Hosting: the platform subdomain structure means the real operator is not evident from the address.

Summary Verdict

The site is assessed as critically untrustworthy and as carrying a high risk of harm. Confirmed blacklisting and consistent malicious classifications from multiple independent sources outweigh the minor technical signals in its favour. Legitimacy cannot be supported, and the real-world operator is not identified.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and WAF, with a valid certificate and only edge addresses observable, so the origin server is not independently visible. These protections are a mitigating factor only. They reduce exposure to generic network attacks, but they do not vouch for the operator. They also make it harder to confirm the real hosting and to detect rapid content swaps. They cannot offset the current threat detections.

Closing Assessment

The site should not be used for login, credential entry, payments or any financial interaction, and no files should be downloaded from it. Any visit should be limited to passive viewing, from an isolated browser or device. Anyone who has already entered credentials or made a payment should change the affected passwords immediately, notify their financial provider, and report the link.