Is listshelping.forum a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

The website is a single-screen crypto "community vote" interstitial that announces a live CoinMarketCap community listing vote and invites visitors to press a Continue button to cast a free vote on a "secure voting page". The page carries almost no content: a short call to action, a "PROTECTION LAYER" label, and a 2026 copyright line crediting a brand called MarketVote. It names no operator, and its apparent purpose is to funnel crypto-interested visitors toward a separate, unnamed destination under the borrowed credibility of a well-known listing platform.

Scam/Impersonation Risk

Contradictory signals are present, and they converge on an elevated-risk reading. Several major security vendors independently flag the domain as malicious or suspicious, and it also appears on an external blacklist, so it is blacklisted by third-party threat sources. The page's own content points the same way. It invokes CoinMarketCap as the sponsor of a "live" listing vote but offers no evidence of that relationship, no voting rules, and no legal entity or contact route. The Continue button redirects to a voting page that the homepage never identifies. This is the classic shape of a lure page. A free, low-effort action borrows a trusted brand and moves the visitor to a second-stage page that can request wallet connections, signatures or credentials. The page itself shows no login form, hidden form or wallet prompt, so the destination is where any harm would occur. Automated sandbox runs also recorded several inline scripts flagged as suspicious and a very large DOM rewrite after interaction, which is out of proportion to a 210-character page and consistent with content being swapped in behind the interstitial. The page's "PROTECTION LAYER" gate adds no verifiable security; it can equally serve to screen automated scanners from the real destination. No brand impersonation was formally confirmed, and no conflicting legal identities exist because none are disclosed. Evidence:

• Homepage: the only substantive text claims that the CoinMarketCap community listing vote is live and that a free vote can be cast via the Continue button, with no operator, rules or contact detail.
• Homepage: the redirect target after Continue is an unnamed "secure voting page", and the only brand shown is MarketVote in the footer.
• Domain registration: created on 2026-09-23 (~0.07 years old, roughly three weeks), so the domain is brand new.
• Web archive: 1 snapshot, first and last seen 2026-09-25 (1 year tracked), so there is no prior history behind the site.

Regulatory Verification Notes

The site makes no licensing, registration or regulatory claim, and none can be tied to the entity behind it. The homepage lists no company name, registration number, jurisdiction, terms or privacy page. Ownership and governance are opaque on the site itself. This is a disclosure gap, and it matters more here because the page presents itself as connected to an established listing platform and asks visitors to proceed to an unspecified destination. No third-party broker or regulatory-database entry was matched, so no external reputational context exists to offset the lack of on-site identity. The pattern of an unnamed operator, no stated value flow and no rules governing the vote means that no regulated or accountable counterparty can currently be identified. Evidence:

• Homepage: no legal entity, license, registration number or address appears anywhere on the page, including the footer that credits MarketVote.
• Hosting: served from AS207043 (DEDIK SERVICES LIMITED), a data-center hosting provider registered in Bulgaria.
• Domain registration: registered through Registrar.eu, with an expiry date of 2027-09-23.
• Transport encryption: TLS certificate issued by YR1 at domain-validation level only, valid to 2026-12-22. This confirms an encrypted channel, not the operator's identity.

What to Verify Next

Any claimed link to CoinMarketCap should be checked through that platform's own official channels, reached independently of this site, to confirm whether a community listing vote of this kind exists and whether this domain is authorized. The voting destination should not be opened with a wallet-enabled browser profile or any account that holds funds. Any follow-up should be limited to isolated, read-only inspection by a security team. Official support and contact channels for the claimed sponsor and for MarketVote should be confirmed through an independent route before any engagement. If the site reached a user through a message, social post or advert, that source should be treated as part of the lure and reported. Evidence:

• Homepage: the vote is described as "free" with no stated cost, reward or token, so the value flow can be established only from the destination page, which the homepage does not name.
• Homepage: the Continue control routes to an unverified second-stage page, which is the step that needs isolated inspection.
• Homepage: no voting rules, operator identity or channel for questions is provided, so the claim cannot be checked on the site itself.

Summary Verdict

The available evidence supports an elevated-risk, clearly cautionary posture. Independent threat detections, a thin lure-style page built on an unverified brand claim, and a domain with no established history reinforce one another. Nothing in the evidence offsets them, and the site should not be treated as a legitimate or trustworthy destination.

Infrastructure Integrity

The domain resolves through Cloudflare's CDN/WAF, which is a mitigating factor only and does not offset the external threat detections. The edge layer also means that the underlying origin server was not observable. The single observed address sits on a shared data-center hosting provider, and the two abuse reports against it apply to that shared provider address rather than specifically to this site, so they carry little weight here. The domain's very young age and sparse DNS footprint are unconfirmed heuristics and are consistent with, but do not independently establish, a short-lived deployment. The valid TLS certificate shows only that traffic is encrypted.

Closing Assessment

The site should be treated as a read-only curiosity at most. Credentials, wallet connections, signatures, payments and any form of login should be withheld from it and from the voting page it leads to, and the link should be reported or blocked where organizational controls allow.

Signals weighed against the site

• AbuseIPDB: 2 reports on hosting IP 91.92.43.159 (DEDIK SERVICES LIMITED, Data Center/Web Hosting/Transit), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.