Is liveallocationpage-ux.netlify.app a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a single-page site hosted on a free subdomain of a developer hosting platform. Its page title presents it as "Jupiter: The Home of Onchain Finance", which suggests a crypto or decentralized-finance landing page. The subdomain name refers to a "live allocation page", so the apparent purpose is to present a token-allocation or onchain-finance interface to visitors. The captured page text is short. No product list, yield figures, leverage claims, or contact artifacts could be extracted from it, so the site's commercial model cannot be described beyond its onchain-finance branding.

Scam/Impersonation Risk

Contradictory signals are present and are serious. The domain is blacklisted: multiple independent security engines classify it as malicious, and several major, well-regarded security vendors are among them. This alone places the site in an elevated-risk category regardless of its other characteristics. The site's behavior adds to the concern. When a visitor interacted with the page, its content changed substantially compared with the initial load, both in visible text and in layout. That pattern is consistent with cloaking, where a page shows one thing at first and something different after engagement. The site brands itself with the name of a widely known onchain-finance product but is served from a free, user-created subdomain on a hosting platform, and that subdomain name closely resembles the platform's own domain. Any real-world link between this site and the brand it displays could not be established. Branded landing pages of this kind are a common vehicle for wallet-phishing and fake token-allocation or airdrop lures. No two conflicting legal identities were found, and the sandbox saw no wallet-connection prompts, clipboard manipulation, hidden forms, or outbound data submissions. These observations slightly narrow the observed attack surface but do not offset the malicious classifications. Evidence:

• Homepage: the page title presents the Jupiter onchain-finance brand on a free hosting-platform subdomain whose name resembles the platform domain, with no verifiable tie to that brand.
• Reputation check: 15 security engines flagged the domain as malicious and 1 as suspicious, including three Tier-1 vendors (Fortinet, Kaspersky, Sophos), which triggered an external blacklist.
• Behavioral sandbox: strong post-interaction cloaking was recorded, with a semantic content difference of about 31% and a visual difference of about 14%, across 3 successful runs.
• Domain provenance: the domain was registered in 2026 (about 15 days old), with a single archive snapshot (1 snapshot, 2026, 1 year tracked), so no prior benign history exists.

Regulatory Verification Notes

Nothing in the evidence connects this site to a regulated financial entity. The site presents an onchain-finance brand but offers no verifiable regulatory standing or independently confirmed corporate identity. Third-party broker-reputation data returned no matching record, which is neutral and carries no weight in either direction. The valid certificate and recognizable hosting environment are generic platform features. They are not evidence that the site's operator is legitimate or authorized to offer financial services. The abuse reports recorded against a network address in the hosting environment relate to shared provider infrastructure and are discounted, so they play no part in this assessment. Evidence:

• Transport encryption: the TLS certificate is OV-validated, issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 to Netlify, Inc, and valid to 2027-03-19. It identifies the hosting platform, not the site's operator.
• Hosting: the site is served from AS16509 (AMAZON-02, Amazon.com, Inc., US), where many unrelated sites share the same address space.
• Homepage: the page offers a financial-style onchain brand, but the evidence reviewed contains no regulator reference or licensing statement tied to it.

What to Verify Next

Before any interaction, the claimed brand should be checked against its officially published domain, obtained from a trusted independent source such as the brand's verified social channels or a bookmarked address. The domain should not be reached through links, messages, or advertisements that led here. Any "allocation", "claim", or "airdrop" promise should be treated as unconfirmed until the genuine brand confirms it through its official channels. If the page is encountered in a message or advertisement, the sender or advertiser should be asked to confirm its origin through a separate, offline route. The official support or contact channels of the brand should also be confirmed independently. Internal security teams may wish to report the domain to the hosting platform and to browser-protection providers. Evidence:

• Homepage: the page title claims a well-known brand while the address is an unrelated free subdomain, so the match with the official domain should fail on inspection.
• Reputation check: the malicious classifications are current, so the page should not be opened on a device that holds wallet access or stored credentials.
• Behavioral sandbox: content shifts after interaction, so a first visual impression of the page is not a reliable indicator of what a visitor is shown later.

Summary Verdict

The available evidence supports a clearly high-risk posture for this website. Confirmed malicious classifications from independent security sources and evasive page behavior outweigh the neutral and mildly positive technical hygiene. The domain's brand-style presentation is also unsupported by any verified identity. The site cannot be treated as trustworthy.

Infrastructure Integrity

The site is delivered through Amazon-operated CDN infrastructure under AS16509, and all four observed addresses are edge servers. The origin server could not be observed, so the actual hosting location cannot be independently confirmed. This setup can also allow content to be changed quickly without any visible change in network location. The hosting is mainstream and its reputation is sound, which is a mitigating factor. It does not offset the external threat detections, because the platform hosts many unrelated sites and gives no assurance about this particular one. The abuse reports on a shared edge address are attributed to the provider's shared infrastructure rather than to this site.

Closing Assessment

The site should not be used for login, credential entry, wallet connection, or any financial interaction. At most, it should be viewed read-only from an isolated environment, and any exposure should be handled as a possible phishing event. Anyone who has already interacted with it should review wallet approvals and account credentials.

Signals weighed against the site

• AbuseIPDB: 2 reports on hosting IP 2a05:d014:58f:6200::259 (Amazon Data Services Ireland Ltd, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.