Is checknewlistvote-ui.netlify.app a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a single-page "Token listing vote" site hosted as a subdomain on a shared developer-hosting platform. It presents a vote or poll interface, apparently about listing a crypto token, and its apparent purpose is to collect participation from visitors, who are likely to be crypto-asset holders.

Scam/Impersonation Risk

Contradictory signals are present and decisive. Multiple established security vendors independently flag the site as malicious, and a confirmed blacklist-level detection applies to it. A threat-intelligence record associates the host with known phishing activity. No brand impersonation or conflicting legal identities were observed, and no contact-email anomaly was reported. The site's own form and navigation structure was not analysed in a way that identifies a specific brand being copied. The hosting name closely resembles its parent platform's domain. Combined with a "vote" theme that invites token holders to act, this fits the pattern of lure pages used to push visitors toward credential, wallet, or approval prompts. In testing, the page made heavy use of third-party network calls, including data submissions to destinations outside the platform's usual whitelisted services. That is unusual for a one-page vote site and warrants treating any data entered as exposed. In the sandbox runs, the page did not trigger wallet-connection prompts, clipboard tampering, hidden forms, or cloaking. This is a mitigating observation and does not offset the detections. Logins, credential entry, wallet connection, and any financial interaction are unsafe. Read-only viewing is the only defensible use. Evidence:

• The domain was registered in 2026 (~0.12 years, about 43 days old), which makes it very young.
• The web archive holds 1 snapshot (2026, 1 year tracked), so there is no established history.
• 17 security engines rated the homepage malicious and 1 rated it suspicious, including three tier-one vendors (Fortinet, Kaspersky, Sophos). A multi-vendor blacklist condition is active.
• The sandbox recorded 103 external XHR requests and 36 external POST requests across 3 runs. 12 of those POSTs went to non-whitelisted destinations, and external traffic reached up to 88.7% at peak.

Regulatory Verification Notes

The site discloses no licensing, registration, or regulated-entity status in any way that could be independently matched. No third-party broker or regulatory profile corresponds to it, and no external regulatory source confirms it. The operator cannot be linked to a real-world company or person, so ownership opacity applies. This is separate from the contradiction findings above and is not an identity conflict. The valid transport certificate belongs to the hosting platform. It shows that the connection is encrypted, not that the site's operator has been vetted. A site that solicits token-related votes would ordinarily be expected to name a responsible project, team, or legal entity. None is established here. Evidence:

• The site is served from AS16509 (AMAZON-02, Amazon.com, Inc., US).
• The TLS certificate is OV-validated and issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1. Its subject organisation is Netlify, Inc, and it is valid to 2027-03-19 (144 days remaining), so it identifies the platform rather than the site owner.
• The homepage title is "Token listing vote". No third-party broker or regulatory profile matches the site.

What to Verify Next

Before any engagement, the token project or exchange that supposedly runs this vote should be confirmed through its official channels, reached independently of this site. The site should be checked against announcements from that project to establish whether the vote is genuine. Wallets, if already connected, should be reviewed for newly granted approvals. Any credentials entered should be rotated. The hosting platform's abuse-reporting channel is the appropriate route for flagging the site. Official support or contact details should also be confirmed through an independent route. Evidence:

• The homepage is the only page analysed, and it carries no independently verifiable operator identity.
• The hosting-name resemblance to the parent platform's domain should be compared with the project's official domain list.
• The 12 non-whitelisted POST destinations seen in testing indicate where entered data may travel.

Summary Verdict

The overall posture is high-risk. External detections converge with a very young domain, no established history, and no verifiable operator identity. The site cannot be treated as legitimate, and its technical hygiene does not change that.

Infrastructure Integrity

The site is delivered through Amazon-operated CDN and WAF infrastructure, and only edge addresses were observable, so the origin server is not independently visible. This is a mitigating factor only, and it cannot offset the external threat detections. Abuse reports recorded against a shared edge address apply to the provider's multi-tenant infrastructure rather than specifically to this site. They are consistent with the reputation concerns above but are not independent proof of them.

Closing Assessment

The site should not be used for any interaction that involves credentials, wallet connection, or funds. Users who have already engaged should secure their accounts and review wallet permissions. The site should be treated as a threat-listed destination until independent cleanup or validation is demonstrated.

Signals weighed against the site

• AbuseIPDB: 4 reports on hosting IP 2a05:d014:58f:6200::258 (Amazon Data Services Ireland Ltd, Content Delivery Network), 1% confidence. The reports are attributed to shared infrastructure, not specifically to this website.