Verdict
This assessment found strong scam indicators. Do not pay, sign in, or share personal details with this site.
listup.blog shows high-risk / scam indicators.
| What this site appears to be | A short gate page claims a live CoinMarketCap community listing vote and asks visitors to continue to a 'secure voting page' to cast a free vote. It is branded 'MarketVote' with a 'PROTECTION LAYER' label and gives no verifiable operator identity, contact details, or documented link to CoinMarketCap. The lure pattern is consistent with a traffic or lead-generation funnel, and the risk is moderate pending the destination and the operator's identity. |
|---|
Evidence status and limitations
Evidence completeness: Not recorded
- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.
At a glance
The checks that decide most of this verdict.
| Malware engines | 2 flagged itVirusTotal | Risk |
|---|---|---|
| Google Safe Browsing | Not listedGoogle | Clear |
| Abuse reports on the host | 1% confidenceAbuseIPDB, 1 report; shared hosting inflates reports | Clear |
| Domain age | 18 days oldMost scam domains are under a year old | Risk |
| Web archive | Archived since 20263 snapshots | Clear |
| Certificate | Encrypted connectionIssued by YR2 | Noted |
The page as captured
Key findings
- Automated classification: Sensitive Interaction Risk.
- Domain age: less than 1 year (registration continuity).
- Public web-archive history exists since 2026.
- At least one reputation service TrustSniffer consulted had flagged this domain at assessment time.
Full analysis
Security Alert
Fortinet flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.
This website is a single-screen "Community Vote" gate page branded "MarketVote" that announces a live CoinMarketCap community listing vote. It invites visitors to press a "Continue" button to reach a "secure voting page" where they can cast a "free" vote. The page offers no product, price or service description, and its apparent purpose is a traffic or lead-generation funnel that sends visitors onward to an undisclosed destination. Its operator's benefit is never stated.
Scam/Impersonation Risk
Contradictory signals are present, and they warrant a clearly cautionary reading. Multiple independent threat-intelligence sources flag the domain, and it is confirmed on external blacklist listings. The page leans on a prominent crypto brand's name and a sense of urgency ("now open", "live") while giving no documented link to that brand. The gate page names no operator beyond the "MarketVote" footer, publishes no contact route, and carries a "PROTECTION LAYER" label that reassures without explaining anything. This is a recognized lure pattern for redirect chains that end in wallet-connection prompts, advertising monetization or credential capture. The destination was not observed, so what follows the "Continue" click is unknown and cannot be treated as benign. Brand impersonation was not formally established, but claiming a tie to a well-known listing platform without proof is a material claim-versus-evidence conflict. The sandboxed behavioral runs showed inline scripts judged suspicious and a very large number of page changes after interaction, on a page that carries almost no visible content. They showed no wallet-connection attempts, clipboard manipulation or cloaking. One abuse report exists against the shared hosting address. It reflects shared provider infrastructure rather than this site specifically, so it is weak corroboration and is not counted against the site on its own.
- Homepage: the only content is a "free vote" prompt, a "Continue" button and a "© 2026 MarketVote" footer. There are no forms, links, social profiles or contact details.
- Reputation checks: 2 engines rate the domain malicious and 3 rate it suspicious, with a tier-one security vendor among the flaggers. The site is also on an external blacklist.
- Domain provenance: the domain was registered on 2026-10-01 (~18 days old, 0.05 years). The web archive holds 3 snapshots, from 2026-10-01 to 2026-10-09 (1 year tracked).
- Hosting address: 1 abuse report, last filed 2026-10-01, on a data-center hosting IP shared with other tenants.
Regulatory Verification Notes
The site makes no licensing, registration or legal-entity claims, and it publishes no terms, privacy, about or contact pages. No operator name, company number, address or complaint channel can be found anywhere on the site. For a page that invites participation in a crypto-related activity, this is a verification gap and not proof of wrongdoing. Here, though, it sits alongside confirmed threat-intelligence listings, so it cannot be read as an innocent omission. No third-party broker or regulator database holds any entry for the site, so there is no external reputational context either way. The valid, unexpired encryption certificate and the registrar relationship are routine and do not attest to the operator's identity or intent.
- Homepage: no legal entity, license, registration number, jurisdiction or contact route is stated beyond the "MarketVote" footer.
- Hosting: served from AS207043 (DEDIK SERVICES LIMITED, GB), with the network registered in the RIPE region and geolocated to Bulgaria.
- Transport encryption: TLS certificate issued by YR2 at the domain-validated (DV) level, valid to 2026-12-30. This confirms encryption only, not the operator's identity.
- Registration: registered through Hosting Concepts B.V. d/b/a Registrar.eu, with the registrant details privacy-redacted. Registration runs to 2027-10-01.
What to Verify Next
Verification should start by checking whether the claimed CoinMarketCap listing vote exists at all. This means navigating to the platform's own official site or announcement channels by typing the address manually or using a trusted bookmark, never through this page's button. Any legitimate community vote would be announced and reachable there. If the destination of the "Continue" step must be examined, that should happen only inside an isolated, disposable analysis environment with no wallet extensions or saved credentials. Finally, the operator behind "MarketVote" should be identified through independent corporate registries or the platform itself, and the domain should be re-assessed later to see whether the threat listings are cleared or increase.
- Homepage: the "Continue" step leads to a destination that was not captured, so the real purpose of the funnel is unobserved.
- Homepage: the page makes a specific claim about a third-party platform and gives no verifiable source for it.
- Behavioral analysis: suspicious inline scripts and large post-interaction page changes mean the page's behavior should be re-tested before any assumption of safety.
Summary Verdict
The site sits in the critical-risk tier. Confirmed threat-intelligence listings, a brand-borrowing lure with no verifiable operator, and a brand-new, thinly evidenced domain converge into a consistent picture of an elevated-risk funnel page. Identity has not been verified, and nothing in the evidence offsets the adverse reputation findings.
Infrastructure Integrity
The site sits behind a Cloudflare CDN/WAF, and the only observed address is an edge address, so the true origin server was not visible. This limits independent verification of the hosting and means content behind the edge could be swapped quickly without a visible change at the network layer. Cloudflare protection is a mitigating factor only. It does not offset the reputation findings, and it says nothing about the operator's intent. The domain's young age and sparse subdomain footprint add to the caution on the network side.
Closing Assessment
The site should not be used for login, credential entry, wallet connection or any financial interaction. The "Continue" button should not be followed from a normal browsing environment. Anyone who wants to take part in a listing vote should reach the platform directly through its official channels. Anyone who has already followed the link and connected a wallet or entered credentials should rotate those credentials and review wallet permissions promptly.
Written analysis generated 2026-10-20 by the TrustSniffer Analysis Engine from the evidence in this report.
What the analysis found
3 findings contributed to this verdict, raised by external reputation, page content, behaviour in a sandbox.
01 External reputation
- An external threat feed lists this domain: either Google Safe Browsing marked it malicious, or a significant number of malware engines flagged it.External reputation
rule:EXT_BLACKLIST_CRITICAL
02 Page content
- The page content shows three or more warning signs that deceptive sites commonly use.Page content
rule:PAGE_RED_FLAGS_STRONG - The page shows few of the signs expected from a trustworthy operator.Page content
rule:PAGE_TRUST_QUALITY_LOW - The review of the page content rated it moderate risk.Page content
rule:PAGE_RISK_MED
03 Behaviour in a sandbox
- The page carried inline scripts written in a style TrustSniffer treats as suspicious.Behaviour in a sandbox
rule:BEHAV_SUSPICIOUS_INLINE_SCRIPTS - The structure of the page changed sharply while it was loading.Behaviour in a sandbox
rule:BEHAV_DOM_DENSITY_SPIKE
Signals weighed against the site
- AbuseIPDB: 1 report on hosting IP 91.92.43.91 (DEDIK SERVICES LIMITED, Data Center/Web Hosting/Transit), 1% confidence. The reports are attributed to shared infrastructure, not specifically to this website.
Identity verification
| Status | UNVERIFIED |
|---|---|
| Identity score | 30/100 |
| Identity verification confidence | 25% |
- No on-site identity signals detected
Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence.
What TrustSniffer observed
First-party facts recorded during the assessment of listup.blog.
- The request stayed on listup.blog. It was not redirected to another domain. Clear
- Registration is published under Hosting Concepts B.V. d/b/a Registrar.eu. Clear
- DNS for this domain is served by cloudflare.com, across 2 name servers. Noted
- The registration is paid up to 2027-10-01. Noted
- The earliest public archive of this site is from 2026-10-01. Clear
- It is hosted on DEDIK-IO, from a server in BG. Noted
Domain intelligence
| Registrar | Hosting Concepts B.V. d/b/a Registrar.eu |
|---|---|
| Hosting | DEDIK-IO - DEDIK SERVICES LIMITED, GB |
| Country | BG |
| Server IP | 91.92.43.91 |
| Name servers | amy.ns.cloudflare.com, brady.ns.cloudflare.com |
| CDN / edge network | Detected (cloudflare) |
| Resolved IP addresses | 1 |
| Edge IP addresses | 1 |
| Likely origin IP addresses | 0 |
| SSL issuer | YR2 |
| SSL expiry | 2026-12-30 |
| Domain age | 0.05 years (continuous registration) |
| Domain expiry | 2027-10-01 |
| Archive first seen | 2026-10-01 |
| Archive snapshots | 3 |
| Reputation | VirusTotal: 2 flagged | AbuseIPDB: 1% confidence, 1 report | Google Safe Browsing: 0 matches |
About this assessment
A trust score summarises the evidence TrustSniffer could collect about listup.blog at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.
TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.