Is arcus-gate-vote.vercel.app safe? TrustSniffer's low-trust assessment: 25/100

Overview

This website is a hostname on a public application-hosting platform whose only visible content is a generic "404 NOT_FOUND / DEPLOYMENT_NOT_FOUND" error screen, with a debug reference code and links labelled "Go back", "View Documentation" and "Copy Debug Prompt". The page shows no products, pricing, forms, branding or service description. Its hostname suggests a voting or gating application, but nothing visible supports that purpose, so no business model can be inferred.

Scam/Impersonation Risk

Contradictory signals are present and drive the cautionary posture. Several independent threat-detection engines currently flag the site as malicious, and an external blacklist listing is confirmed, so the site is blacklisted on external reputation evidence. Browser-behaviour testing found strong cloaking. The rendered content changed materially after simulated interaction, which is consistent with a page that shows one face to automated or passive visitors and another to engaged users. The visible 404 page may therefore not represent what the deployment serves in other circumstances. The hostname also closely resembles the hosting platform's own domain, a typo-style similarity that raises brand-lookalike suspicion. No phishing form, hidden form, wallet-connection behaviour or conflicting legal identity was observed, so this is a lookalike concern rather than a confirmed impersonation. A large body of abuse reports exists against the shared platform address the site resolves to. That address is reported as shared infrastructure with no reputational confidence against it, so the reports are discounted and not attributed to this site. They are not the basis of the concern. Across the sandbox runs, the page made heavy external request traffic, mostly to third-party endpoints that were not flagged as suspicious, and one tracker, one analytics component and one ad component were detected on a page that displays no content. Evidence:

• Homepage: renders only a deployment-not-found error with no descriptive content, forms or links to a service.
• Behaviour testing across three successful runs: strong cloaking, with a clear semantic and visual difference in page content after interaction.
• Domain registered about 22 days before analysis (2026), a very recent hostname.
• Web archive holds a single snapshot, captured 2026-09-29, giving 1 year tracked and no meaningful history.

Regulatory Verification Notes

The site discloses no legal entity, operator, licence, registration number, terms or privacy pages. The only page captured is an error screen, so there is no legal or identity content to assess, and the real-world operator cannot be linked to any brand or person. No broker or regulatory-database match exists, and no third-party regulatory verdict applies. Ownership is opaque, and the site gives a visitor no basis for judging who is accountable for it. The adverse conclusions in this report rest on the threat-detection and behavioural findings above, not on this absence of disclosure. Evidence:

• Homepage: no company name, licence, registration, contact or policy information is shown.
• Served from AS16509 (AMAZON-02 - Amazon.com, Inc., US), registry ARIN, country US.
• TLS certificate issued by WR1 (DV, domain-validated only), valid to 2026-11-27, which confirms encryption but not operator identity.

What to Verify Next

Anyone who received this link should confirm through an independent route, such as the project's official site or a known contact reached offline, that the deployment is genuine and intended. If it was shared by message or social media, its origin should be checked with the sender through a separate channel. Security teams should re-test the hostname later, because the error page may be a placeholder that is later replaced with live content. Any such re-test should happen in an isolated environment, with attention to whether the cloaking behaviour persists. If real content appears, the operator's legal identity and any applicable licensing should be confirmed with the relevant registry before any engagement. Evidence:

• Homepage: the deployment-not-found response indicates the application is absent or removed, so what is meant to be served is unknown.
• Behaviour testing: content shifted after interaction, so a one-time observation does not settle what the site serves.
• Reputation checks: multiple detections and a blacklist listing remain active, so the status should be re-checked before any reconsideration.

Summary Verdict

The available evidence supports an elevated-risk posture. Active malicious detections, a confirmed blacklist listing and strong cloaking behaviour outweigh the neutral error-page content, and the operator's identity is unverified. Valid encryption and the standard hosting platform are technical hygiene only, and do not offset the reputational and behavioural findings. Read-only observation is the only use consistent with this assessment.

Infrastructure Integrity

The site sits behind a CDN/WAF layer on a major cloud network. All observed addresses are edge servers, with no origin server address observable, and the platform is a trusted provider. That mitigates direct exposure and confirms legitimate hosting. It cannot offset the reputation findings, and edge-only visibility makes it harder to verify hosting independently and to detect rapid content swaps.

Closing Assessment

Do not log in, submit credentials, connect a crypto wallet, make payments or download files from this site. If it was reached through an unsolicited link, treat that link as untrusted and report it to the sender or the relevant security team.

Signals weighed against the site

• AbuseIPDB: 103 reports on hosting IP 216.198.79.195 (Vercel, Inc, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.