Is list-voteokx.pages.dev a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a page on a free, shared subdomain of a developer hosting platform. Its hostname pairs the words "list" and "vote" with "okx", which reads like a prelude to a crypto-exchange-themed voting or listing page. When it was fetched, the visitor-facing content was a warning interstitial from the hosting platform. That interstitial was titled as a suspected phishing notice and returned an access-denied response, so the site's real purpose and business model could not be established from its own pages.

Scam/Impersonation Risk

The site carries confirmed external threat detections. Several independent threat-intelligence engines classify it as malicious, and at least one tier-one security vendor is among them. It is treated as blacklisted. Separately, the hosting platform's own protective layer presented a suspected-phishing interstitial instead of the page, which is consistent with those detections. The hostname embeds a string resembling a well-known cryptocurrency exchange brand inside a throwaway subdomain. No brand impersonation or conflicting legal identities were confirmed, but this pattern is typical of lookalike campaigns that lure visitors toward wallet connections, credential entry or fake "voting" and "listing" flows. Browser-behaviour testing showed no wallet-connection prompts, clipboard tampering, hidden forms, or externally posting password fields. This does not offset the detections, because the real page was gated and the tested content may not represent what a targeted visitor would see. Evidence:

• Homepage: the capture returned an access-denied interstitial titled as a suspected phishing warning, rather than site content.
• Reputation: 4 engines flag the domain as malicious and 2 as suspicious, including one tier-one security vendor.
• Homepage behaviour: about 95% of observed network activity was directed to external destinations (20 external data requests and 4 external form submissions), all to recognised destinations, with 15 browser console errors recorded across 3 test runs.
• Homepage: the page rendered by the sandbox contained only a short block of text, with no identifiable product, company or login interface.

Regulatory Verification Notes

No legal, terms, privacy or about pages could be retrieved, so no operator name, licence, registration number or jurisdiction is available for assessment. Because the content was gated, this reflects an inability to review the site, not a confirmed omission by the operator. Real-world identity is unverified, and the site is not a licensed or regulated entity. Nothing found can connect it to any exchange whose name its hostname resembles. No broker-reputation database entry was found for it, so no third-party reputational context exists beyond the threat detections above. Evidence:

• Hosting infrastructure: served from AS13335 (Cloudflare, Inc., US).
• Transport encryption: TLS certificate issued by WE1 at domain-validation level only, valid to 2026-12-31. This confirms encrypted transport but says nothing about who operates the site.
• Domain structure: the site runs on a shared platform subdomain, not on an independently registered domain.

What to Verify Next

Anyone who received this link, for example through a message, social post, or an advertisement promising a vote, listing or reward, should treat it as unsolicited. They should confirm the claim through the official channels of the exchange or project it appears to reference, reached by typing the known address directly or using its official application. They should also confirm any related announcement through an independent route, not through contacts published on this site. If the link arrived through a messaging or social account, they should check whether that account is genuine. Reporting the link to the hosting platform and to the sender's platform is appropriate. Evidence:

• Homepage: the hosting platform's interstitial indicates the content has already been flagged, so a removal or takedown status check is a reasonable step.
• Hostname: the embedded exchange-style name cannot be tied to any verified operator.
• Browser testing: no wallet or credential prompts were observed, so any such request appearing later should be treated as a significant escalation.

Summary Verdict

The overall posture is high risk. Confirmed external threat detections and the hosting platform's own phishing warning outweigh the valid encryption and the absence of observed wallet-drainer behaviour. The site's identity and purpose remain unverified, and the evidence supports no presumption of legitimacy.

Infrastructure Integrity

The site is delivered through Cloudflare's CDN and WAF. All four observed addresses are Cloudflare edge servers, and the origin server was not observable. The transport certificate is valid and from a known issuer. These traits are mitigating at most: shared edge hosting is common to legitimate and malicious sites alike, and it cannot offset the reputation findings or confirm who operates the site.

Closing Assessment

The site should not be used for login, credential entry, wallet connection or any payment or financial action. Any link to it should be treated as hostile and not shared. If it has been opened, no information should have been entered. If any was, passwords should be changed immediately, wallet approvals should be reviewed and revoked, and the matter should be reported to the relevant platform.