Verdict
This assessment found strong scam indicators. Do not pay, sign in, or share personal details with this site.
poll-okxvote-439.pages.dev shows high-risk / scam indicators.
| What this site appears to be | Kiwi.com's token voting page lets users enter a token contract address to view its voting page, vote on Dexscreener-sourced token listings, and earn XP and Kiwi perks. The page links to a crypto exchange offering buy, trade, convert, and P2P services, and states MFSA CASP authorisation under MiCA. |
|---|
Evidence status and limitations
Evidence completeness: Not recorded
- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.
At a glance
The checks that decide most of this verdict.
| Malware engines | None flagged itVirusTotal | Clear |
|---|---|---|
| Google Safe Browsing | Not listedGoogle | Clear |
| Abuse reports on the host | 0% confidenceAbuseIPDB, 0 reports; shared hosting inflates reports | Clear |
| Domain age | 4 days oldMost scam domains are under a year old | Risk |
| Web archive | Archived since 20261 snapshot | Clear |
| Certificate | Encrypted connectionIssued by WE1 | Noted |
The page as captured
Key findings
- Automated classification: Sensitive Interaction Risk.
- Domain age: less than 1 year (registration continuity).
- Public web-archive history exists since 2026.
- No flags from the reputation services TrustSniffer consulted at assessment time.
Full analysis
Overview
This website is a single-page "Token Voting" feature landing page. It presents itself as part of the Kiwi.com crypto exchange. Visitors are invited to enter a token contract address, vote on Dexscreener-sourced token listings, and earn XP and "Kiwi" perks for YES votes. The page navigation and footer advertise a centralised exchange offering buying, trading, conversion, P2P trading, trading bots and an app. The apparent business model is fee-based exchange services, with the voting tool as a gamified engagement hook. The page is hosted on a free subdomain of a developer-hosting platform rather than on a branded corporate domain.
Scam/Impersonation Risk
No contradictions were observed. There were no confirmed threat-listing hits, no conflicting legal entities, and no confirmed impersonation or phishing finding. Even so, the provenance picture is unresolved. The site carries the Kiwi.com name and copyright line, yet it is served from a disposable-style subdomain whose name references a different exchange's "vote" campaign. That domain was created only days before analysis. Automated brand-similarity checks flagged the hosting domain as a lookalike construct, and a single third-party reputation engine marked the site as suspicious, with no corroboration from other sources. That is a soft reputational signal, not a confirmed listing. Behavioural testing observed several outbound POST and XHR requests to non-allow-listed external destinations, a few of them to unrecognised endpoints. This matters because the page's mechanic centres on pasting token contract addresses and trading-adjacent engagement, and the page is thin in its on-page content. No wallet-connection prompts, clipboard manipulation, hidden forms or credential forms were observed, and the page makes no deposit, yield or guaranteed-return promises. The headline concern is a mismatch between the brand shown and the domain delivering it. This is a verification problem, not a proven deception.
- Homepage: branded as Kiwi.com with a 2017–2025 copyright line and exchange product menus, but served from a free developer-platform subdomain.
- Domain registration: created in October 2026 (~0.01 years, about 2 days old); the web archive holds 1 snapshot, first and last seen 2026-10-17 (1 year tracked).
- Behavioural sandbox across 3 runs: 9 external requests, 6 non-allow-listed, including 3 external POSTs.
- Homepage forms: none; no login form, no wallet-connect activity, no clipboard writes.
Regulatory Verification Notes
The footer states that a "Europe Limited" entity, operating under the trade name, is authorised as a Crypto-Asset Services Provider by the Malta Financial Services Authority under Article 28 of the Maltese Markets in Crypto-Assets Act. The sentence is grammatically fragmentary and names no complete legal entity, and no authorisation number is given. That claim cannot be confirmed from the page and remains an on-site assertion only. The Terms of Service, Privacy Notice, Disclosures and Formal complaints pages are linked but were not part of the captured evidence. The corporate operator therefore cannot be tied to this host from what was observed. No third-party broker-reputation match was found for the site. This is a verification gap, not evidence of wrongdoing by itself.
- Homepage footer: MFSA authorisation statement with an incomplete entity name and no licence reference.
- Homepage footer: links to Terms of Service, Disclosures, Formal complaints and Channel verification are present, but their content was not captured.
- Hosting: AS13335 (Cloudflare, Inc., US).
- Transport encryption: TLS certificate issued by WE1 (DV, domain-validated only), valid to 2026-12-04 with 44 days remaining.
What to Verify Next
The Kiwi.com operator's official domain should be confirmed independently, for example by typing the known address directly or using the official app. Then check that this voting page is actually published there. The claimed Maltese authorisation should be looked up in the MFSA's public register by entity name, and the entity named there should be compared with the legal entity named in the official Terms of Service. The official support and channel-verification pages should be used to confirm that this token-voting campaign and its XP and perk rewards are genuine. Contact channels should be confirmed through an independent route rather than links on this page.
- Homepage: the footer's "Channel verification" and "Support center" entries are the on-site routes for confirming official channels.
- Homepage: the regulatory sentence supplies the register type (MFSA, MiCA Article 28) to search.
- Domain registration: very recent creation, which makes a cross-check against the operator's established domain especially relevant.
Summary Verdict
The overall posture is clearly cautionary. A very young, free-hosted domain carries an established exchange's branding and a regulatory claim that cannot be corroborated. The mitigating points are a clean absence of confirmed threat listings, no credential or wallet capture, and no yield promises. Those points do not outweigh the unresolved brand-to-domain relationship. The available evidence supports neither a confirmation of legitimacy nor a finding of confirmed fraud.
Infrastructure Integrity
The site sits entirely behind Cloudflare's CDN and WAF, and all four observed addresses are Cloudflare edge servers in the United States. The true origin server is not observable. This is a mitigating factor only. It offers protection against basic attacks, but it also prevents independent verification of the actual host and can mask rapid content changes. It says nothing about who operates the site. The TLS certificate is valid and from a recognised issuer, but it only proves control of the domain name.
Closing Assessment
Until the page is confirmed as published by the exchange's official domain, it should be treated as unconfirmed. Any sign-in, payment or contract-address entry should take place only on an address reached through an independently confirmed official route.
Written analysis generated 2026-10-20 by the TrustSniffer Analysis Engine from the evidence in this report.
What the analysis found
4 findings contributed to this verdict, raised by hosting and network, history in the web archive, page content, behaviour in a sandbox.
01 Hosting and network
- The domain was registered less than three months ago.Hosting and network
rule:DNS_NEW_DOMAIN_90D
02 History in the web archive
- The web archive has almost no record of this domain, which fits a site that is new.History in the web archive
rule:ARCH_PEN_YOUNG_AND_SPARSE
03 Page content
- The page appears to present itself as a known brand it is not verified to belong to.Page content
rule:PAGE_BRAND_SUSPECTED - The page has no description for search engines, which established sites usually provide.Page content
rule:PAGE_SEO_MISSING_META
04 Behaviour in a sandbox
- The page sent data to a destination TrustSniffer does not recognise.Behaviour in a sandbox
rule:BEHAV_NONWHITELISTED_POSTS
Identity verification
| Status | UNVERIFIED |
|---|---|
| Identity score | 30/100 |
| Identity verification confidence | 50% |
- No on-site identity signals detected
Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence.
What TrustSniffer observed
First-party facts recorded during the assessment of poll-okxvote-439.pages.dev.
- The request stayed on poll-okxvote-439.pages.dev. It was not redirected to another domain. Clear
- The earliest public archive of this site is from 2026-10-17. Clear
- It is hosted on CLOUDFLARENET, from a server in US. Noted
Domain intelligence
| Registrar | Not available |
|---|---|
| Hosting | CLOUDFLARENET - Cloudflare, Inc., US |
| Country | US |
| Server IP | 2606:4700:310c::ac42:2c96 |
| Name servers | Not available |
| CDN / edge network | Detected (cloudflare) |
| Resolved IP addresses | 4 |
| Edge IP addresses | 4 |
| Likely origin IP addresses | 0 |
| SSL issuer | WE1 |
| SSL expiry | 2026-12-04 |
| Domain age | 0.01 years (continuous registration) |
| Domain expiry | Not available |
| Archive first seen | 2026-10-17 |
| Archive snapshots | 1 |
| Reputation | VirusTotal: 0 flagged | AbuseIPDB: 0% confidence, 0 reports | Google Safe Browsing: 0 matches |
About this assessment
A trust score summarises the evidence TrustSniffer could collect about poll-okxvote-439.pages.dev at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.
TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.