Is Pages a scam? TrustSniffer's high-risk assessment of zerolend-ddr.pages.dev: 0/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This hostname is a subdomain on a shared page-hosting platform. Its label closely resembles the name of a decentralized-finance lending protocol, and it exposes no readable storefront or product content. When automated analysis requested the homepage, the visitor-facing content was a security interstitial headed "Suspected Phishing", served with an access-denied response instead of a normal page. Its apparent purpose is to present a DeFi-style interface under a borrowed or imitated protocol name. It reads as a possible credential or wallet-interaction lure, not as an independent business.

Scam/Impersonation Risk

The evidence converges on a confirmed, serious reputational threat. Multiple independent security engines currently classify the site as malicious, including three leading endpoint-security vendors, and an external blacklist listing is confirmed. This triggered the strongest class of automated protective response. The hosting platform's own interstitial describes the site as suspected phishing, which corroborates the engine detections. The hostname is also a near match for a recognised DeFi lending brand placed under a generic hosting domain. That pattern is typical of lookalike deployments aimed at users searching for the genuine protocol. No second legal-entity name appeared, so there is no identity contradiction in the narrow sense. The threat case rests on the blacklist and phishing indicators, not on conflicting company identities. Behavioural testing showed that nearly all outbound traffic went to external destinations. It also showed heavy background requests, a large page-structure change after interaction, and repeated browser console errors. These are consistent with a dynamically assembled front end. No wallet-drainer routines, clipboard tampering, hidden forms or credential posts to outside hosts were observed in the test runs. That narrows the specific attack mechanics seen but does not offset the confirmed listings. Evidence:

• Homepage: access was met with a challenge page titled "Suspected Phishing" and a 403 response, not site content.
• Reputation checks: 12 engines rated the site malicious and 1 suspicious, with three tier-1 security vendors among them. An external blacklist hit is confirmed.
• Hostname: the label imitates a known DeFi lending protocol's name on a shared hosting domain, with a high lookalike similarity to the platform's own domain.
• Behavioural runs (3 of 3 completed): about 96% of outbound requests were external, 53 external background requests, 14 console errors, and a 1,503-node page-structure change after interaction.

Regulatory Verification Notes

No regulated status could be associated with this site. No licence, registration number or supervisory record was identified. The only content captured was the warning interstitial, so no terms, privacy, about or legal pages were available to assess for company identity or disclosures. Real-world operator identity remains unverified, and the shared-platform subdomain provides no corporate attribution. The site was not recognised as a listed protocol in the DeFi directory consulted. No third-party broker-reputation record matched. This section reaches no regulatory conclusion. The substantive concern is the threat-intelligence picture above, not a licensing gap. Evidence:

• Legal and identity pages: none could be observed beyond the interstitial, so no operator or licence claims exist to assess.
• Hosting domain: the site runs on a shared subdomain, so no standalone registrant identity is attached to the hostname.
• DeFi directory: the site is not listed as a recognised protocol, so it has no TVL or market-cap record.
• Broker-reputation dataset: no match.

What to Verify Next

Anyone seeking the genuine protocol should obtain its official address from an independent source. Suitable sources are the project's verified social accounts, its documentation, or a recognised protocol aggregator, not from search results, messages or links. The address in use should be compared character by character with that official one. Any wallet that has already interacted with this site should be reviewed for token approvals, and unneeded approvals should be revoked. Organisations should report the hostname to the hosting platform's abuse channel and block it at the network and DNS level. Any claimed support or contact channel should be confirmed through an independent route before it is relied on. Evidence:

• Hostname: its resemblance to a known protocol brand makes address comparison the primary check.
• Reputation findings: the detections and blacklist listing are current, so the site is unsuitable for any interaction until delisted and cleaned.
• Behavioural runs: no wallet-connection routines were exercised, so token-approval exposure for past visitors cannot be assessed.

Summary Verdict

The overall posture is high risk. Confirmed blacklisting and consistent malicious detections outweigh every neutral or favourable technical attribute. Operator identity is unverified and nothing credible supports an assumption of legitimacy. The site is assessed as a probable lookalike or phishing deployment.

Infrastructure Integrity

The site is served entirely through Cloudflare's CDN/WAF, and all observed addresses are Cloudflare edge servers. The origin server was not observable, so independent verification of the real hosting location is not possible. The transport encryption is a valid domain-validated certificate from a mainstream issuer, and bot protection is active. These factors are mitigating only. They show that the site is professionally fronted, not that it is legitimate, and they cannot outweigh the reputation findings. Evidence:

• Served from AS13335 (Cloudflare, Inc., US), with four edge addresses observed across IPv4 and IPv6 and no origin candidates.
• TLS certificate issued by WE1 (DV), valid to 2027-01-14, with SAN entries present.
• Bot-protection challenge from Cloudflare observed on every capture attempt.

Closing Assessment

The site should not be visited for any purpose beyond security analysis. Wallets must not be connected, credentials must not be entered, and no funds or approvals should be submitted. Anyone who has already interacted with it should treat their accounts and wallet approvals as potentially exposed and act accordingly.