Verdict
This assessment found strong scam indicators. Do not pay, sign in, or share personal details with this site.
x-validator-credentials-check.pages.dev shows high-risk / scam indicators.
Evidence status and limitations
Evidence completeness: Not recorded
- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.
At a glance
The checks that decide most of this verdict.
| Malware engines | 10 flagged itVirusTotal | Risk |
|---|---|---|
| Google Safe Browsing | Not listedGoogle | Clear |
| Abuse reports on the host | 0% confidenceAbuseIPDB, 0 reports; shared hosting inflates reports | Clear |
| Domain age | Not availableNo registration record was returned | Noted |
| Web archive | Never archivedNo public history of this site | Watch |
| Certificate | Encrypted connectionIssued by WE1 | Noted |
The page as captured
Key findings
- Automated classification: Sensitive Interaction Risk.
- At least one reputation service TrustSniffer consulted had flagged this domain at assessment time.
Full analysis
Security Alert
Fortinet, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.
This website is a subdomain on a shared static-hosting platform. Its hostname is built around the phrases "validator", "credentials" and "check", which suggests a page meant to prompt visitors to validate or re-enter account credentials. When captured, it presented only a short interstitial warning page titled as suspected phishing instead of any business content. No product, service, brand or company is identifiable on it. Its apparent purpose is a credential-validation lure rather than a legitimate commercial or informational offering.
Scam/Impersonation Risk
This is a high-risk assessment, and the main driver is external threat intelligence. Several independent security engines flag the domain as malicious, including two tier-one vendors, so it carries a confirmed blacklist-level listing. The platform's own protective layer also withheld the real page. It returned a restrictive response with an interstitial titled as suspected phishing, which reinforces the external verdicts. The hostname is itself a lure pattern, since a "credentials check" label on a throwaway subdomain is a typical way to induce credential entry. No conflicting legal entities were found, and no brand impersonation was confirmed by name. The weight of the assessment rests on the blacklist-level reputation and the credential-themed construction. In the behavioural sandbox, page activity was dominated by outbound requests to third-party endpoints. That included a large volume of background requests and several outbound data submissions, and the page generated a notable number of script errors. All of these requests went to recognised destinations. The sandbox found no wallet-drainer behaviour, clipboard manipulation, hidden forms or password forms posting to external hosts. The visitor-facing risk is therefore concentrated in the credential lure and the reputation listing, not in an observed on-page exploit.
- Homepage capture: the page returned a 403 restriction and an interstitial titled as suspected phishing, with only a short block of text and no site-authored content.
- Reputation: 10 malicious and 1 suspicious detections were recorded across the engines evaluated, including two tier-one security vendors, and an external blacklist hit was confirmed.
- Behavioural sandbox (3 of 3 runs completed): 29 external background requests and 5 external POSTs, up to 95% of page activity directed externally at peak, and 18 console errors. There were no non-whitelisted destinations, wallet-connect or drainer activity, clipboard writes, hidden forms or external password forms.
- Hostname: the credential-validation wording in the domain name is the only intent signal available, as the page exposes no authored content.
Regulatory Verification Notes
No legal entity, licence, registration number or regulator reference can be attributed to this site. The captured page contains no legal, terms, privacy or about content, so on-page disclosure remains unclear and ownership is opaque. Credential collection of any kind would require a clearly identified, accountable operator, and none is evident. This site is not presented as a regulated financial service, so the absence of licensing is a verification gap and not a finding of fraud in itself. The site's risk assessment rests on its external reputation listing and not on missing disclosures. No broker-reputation record is associated with it.
- Homepage capture: only a platform interstitial was retrieved, with no operator name, legal entity, licence or registration reference.
- Hosting: served from AS13335 (Cloudflare, Inc., US) under the ARIN registry, on a shared platform subdomain with no dedicated corporate domain.
- Transport security: a TLS certificate issued by WE1 at DV level is valid to 2027-01-01. This confirms only that the connection is encrypted, not who operates the site.
What to Verify Next
Any message, advertisement or link that directed a visitor here should be treated as suspect. The sender's claim should be confirmed through the official website or support channel of the service it purports to represent, reached independently by typing the address or using a known bookmark. Anyone who has already entered account details on the page should change those credentials immediately from a trusted device, revoke active sessions, enable multi-factor authentication and review the account for unauthorised activity. Security teams should block the hostname at the web and email gateway and search logs for earlier visits or clicks. The hosting platform's abuse process is the appropriate route for reporting the page.
- Hostname: the credential-validation naming means the originating message or link, not this site, is the first thing to authenticate.
- Reputation: the blacklist-level listing means the site should be blocked and logged by enterprise controls.
- Homepage capture: the platform's suspected-phishing interstitial supports reporting through the hosting provider's abuse channel.
Summary Verdict
The site is assessed as critical risk and clearly unsafe for any sensitive interaction. Confirmed adverse reputation findings from multiple security sources are decisive, and no positive technical signal offsets them. Identity and operator accountability remain unestablished, so there is no basis for a legitimacy conclusion.
Infrastructure Integrity
The site sits behind Cloudflare's CDN and WAF. All four observed addresses are Cloudflare edge servers, and the origin server was not observable. Cloudflare's bot-challenge layer was active during capture. The certificate is valid and the infrastructure is mainstream, which mitigates only technical-exposure concerns. It does not indicate the operator's legitimacy and cannot offset the reputation findings. Edge-only visibility also prevents independent verification of where the content is actually hosted.
Closing Assessment
The site should not be visited for any purpose beyond security analysis, and no credentials, personal data or payment details should be submitted to it. If it is reached through an unsolicited message, that message should be discarded and reported.
Written analysis generated 2026-10-27 by the TrustSniffer Analysis Engine from the evidence in this report.
What the analysis found
3 findings contributed to this verdict, raised by external reputation, behaviour in a sandbox, registration and ownership.
01 External reputation
- An external threat feed lists this domain: either Google Safe Browsing marked it malicious, or a significant number of malware engines flagged it.External reputation
rule:EXT_BLACKLIST_CRITICAL
02 Behaviour in a sandbox
- Most of what the page loaded came from other domains rather than from this one.Behaviour in a sandbox
rule:BEHAV_EXTERNAL_RATIO_HIGH - The page produced an unusually high number of errors while it ran.Behaviour in a sandbox
rule:BEHAV_CONSOLE_ERRORS_HIGH - The page made many background requests to other domains while it was open.Behaviour in a sandbox
rule:BEHAV_EXTERNAL_XHR_HEAVY - The page sent data to other domains many times while it was open.Behaviour in a sandbox
rule:BEHAV_EXTERNAL_POSTS_HEAVY
03 Registration and ownership
- The public registration record for this domain is incomplete.Registration and ownership
rule:KF_WHOIS_INCOMPLETE
Identity verification
| Status | UNKNOWN |
|---|---|
| Identity score | 50/100 |
| Identity verification confidence | 30% |
- AI page analysis unavailable (page captured; identity not AI-verified)
Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence.
What TrustSniffer observed
First-party facts recorded during the assessment of x-validator-credentials-check.pages.dev.
- The request stayed on x-validator-credentials-check.pages.dev. It was not redirected to another domain. Clear
- It is hosted on CLOUDFLARENET, from a server in US. Noted
Domain intelligence
| Registrar | Not available |
|---|---|
| Hosting | CLOUDFLARENET - Cloudflare, Inc., US |
| Country | US |
| Server IP | 2606:4700:310c::ac42:2d0b |
| Name servers | Not available |
| CDN / edge network | Detected (cloudflare) |
| Resolved IP addresses | 4 |
| Edge IP addresses | 4 |
| Likely origin IP addresses | 0 |
| SSL issuer | WE1 |
| SSL expiry | 2027-01-01 |
| Domain age | Not available (no registration date was returned) |
| Domain expiry | Not available |
| Archive first seen | Not available |
| Archive snapshots | 0 |
| Reputation | VirusTotal: 10 flagged | AbuseIPDB: 0% confidence, 0 reports | Google Safe Browsing: 0 matches |
About this assessment
A trust score summarises the evidence TrustSniffer could collect about x-validator-credentials-check.pages.dev at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.
TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.