What is ghost-dp28370oeo5a.edgeone.dev? When we checked, the site returned a generic 404 error — not exactly a welcoming homepage. It's hosted on Tencent's EdgeOne platform, which is a legitimate content delivery network, but that doesn't tell us who actually runs this subdomain or what they intended to put here. The domain has no history in the Wayback Machine, no social media presence, and no about page. Even the WHOIS records are blocked, so we can't see when it was registered or by whom. For a site that seems to be nothing more than a dead endpoint, there's no real reason to visit or interact with it. If you came across this URL expecting a service or product, you won't find one. The combination of anonymity, zero track record, and a completely empty page means there's nothing here to evaluate — and that lack of evidence is itself a reason to treat this URL with caution. It's not that we found proof of a scam; it's that we found nothing at all, which for a functional web address is unusual and concerning.
No — ghost-dp28370oeo5a.edgeone.dev doesn't look safe
In plain English
This site is essentially a broken page with no identity and no history. It returns a 404 error and reveals nothing about who put it there or why. I'd steer clear — there's nothing here worth trusting, and too many unknowns to take a chance.
What you should do now
Don't panic. These steps limit the damage, and the sooner you take them the better.
Don't enter any details
No passwords, card numbers or personal information — even if the site looks professional.
Close the tab
Especially if you got here from an email, text message or social media ad.
Already paid? Call your bank
Contact your bank or card provider right away. They can often stop or reverse a recent payment.
Warn others
Report the site and share this check with anyone who sent you the link.
Where the score comes from
The connection is encrypted with a valid certificate and modern TLS, but the server also accepts older, vulnerable protocols and doesn't enable browser-level protections like clickjacking prevention. Not alarming on its own, but not a sign of careful maintenance either.
There's no way to tell who runs this site. The domain ownership is hidden from WHOIS checks, and the page itself has no about section, no branding, and no team information. For any site that wants to be taken seriously, this kind of anonymity is a major red flag.
The site hasn't triggered any malware scanners or blacklists, but it also has zero web history and no external presence. It's as if the site appeared out of nowhere with no track record to judge — that makes it hard to trust.
The site does list some way to contact the owner, but that's it. There's no explanation of what the site is for, no company details, no social media links, and no branding. It feels like a placeholder rather than a real business.
Missing privacy policy and terms of service, but since this page is essentially a broken endpoint with no user interaction, those omissions aren't a compliance problem. They just reinforce that the site isn't set up for public use.
The basic technical setup works — DNS resolves and a valid certificate is in place — but the site lacks security headers, email handling, and DNSSEC. It's a bare-bones configuration that might be fine for a test page, but not for anything meaningful.
What we checked
Think this verdict is wrong?
Site owners can request a fresh scan. Scores update automatically as signals change.