Is ponsvote-listingv1.netlify.app a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This is a Netlify-hosted site whose root page returns the platform's default "Site not found" 404 error screen. It shows no products, branding, navigation, forms or stated purpose, so the visitor sees only a generic hosting error, and no business model can be identified from it. The hostname, which reads like a "vote listing" service, suggests it was set up as a staging or campaign-style deployment.

Scam/Impersonation Risk

This is a clearly cautionary assessment. The site is blacklisted. A substantial number of independent security engines currently flag the hostname as malicious, including two tier-one vendors (Fortinet and Sophos). Detections at that scale and vendor quality are decisive, and the shared hosting platform and valid certificate do not offset them. The detections are not tied to a specific category such as phishing or malware delivery, but the listing alone is enough to treat the site as hostile. Behavioral testing also found concealed forms, including password-type inputs, in every one of the repeated sandbox runs, and the page changed heavily after interaction. The visible page shows no forms, so this mismatch between the visible page and its hidden behavior is characteristic of credential-harvesting staging pages. The hostname structurally mimics the hosting platform's own naming, and a brand-similarity heuristic fired on it, but no confirmed impersonation of a specific brand was established. No conflicting legal identities were observed. The few abuse reports against one of the serving addresses belong to shared provider infrastructure and are discounted as not attributable to this site. Evidence:

• Homepage: external threat detections are present across multiple security engines, including two tier-one vendors, and the site is on at least one confirmed blacklist.
• Homepage behavioral testing: hidden forms with password-type fields appeared in all three sandbox runs, while the rendered page displays only a 404 notice.
• Homepage behavioral testing: very large DOM mutations after interaction (about 4,130 changes), which is anomalous for a static error page.
• Domain provenance: registered about 29 days ago (~0.08 years old); web archive holds 1 snapshot, first and last seen 2026-09-22 (1 year tracked).

Regulatory Verification Notes

The only page reachable is the platform's default error screen. It carries no legal entity, terms, privacy policy, contact details or licensing statement, so the operator cannot be tied to any real-world person or business, and ownership is opaque. Nothing in the site claims a financial license or regulatory registration. No third-party broker or regulatory-database record matches the site, so there is no external reputational signal on this point. The only remaining certificate-level identity is that of the hosting platform rather than of the site's operator. Evidence:

• Homepage: no company name, address, license number or legal pages are present.
• Hosting: served from AS16509 (AMAZON-02, Amazon.com, Inc., US).
• Transport encryption: TLS certificate issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 (OV), subject organization Netlify, Inc, valid to 2027-03-19.

What to Verify Next

Any claim that this address is legitimate should be treated as unproven until the operator is identified through an independent route. Confirm the intended destination of any link or message that led to this hostname with the party that supplied it, using an offline or separately sourced channel. Check whether the hostname is an authorized property of a known organization by asking that organization directly, and report the address to the hosting platform's abuse desk if it arrived through an unsolicited message. Re-test only after the hostname is delisted and shows a verifiable operator and content. Evidence:

• Homepage: it offers no content, contact route or entity that could be validated directly.
• Hostname: the "vote listing" wording gives no indication of the organization it is meant to represent.
• Reputation: current threat listings should be re-checked and cleared before any change in handling.

Summary Verdict

The site is rated critical-risk. Active external threat detections, concealed credential-style form behavior, and a very recent, unattributed deployment converge on a hostile posture, and nothing in the evidence supports treating it as a legitimate service. Technical hygiene does not change this conclusion.

Infrastructure Integrity

The site is served from Amazon-operated address space behind the hosting platform's CDN/WAF layer, and every observed address is an edge node, so the origin server is not visible. The edge nodes are shared provider infrastructure, which is why abuse reports against one of them are discounted. This protective layer is only a mitigating factor. It does not independently confirm where the content is hosted, and it can allow content to be swapped quickly without any visible change in network location.

Closing Assessment

The site should not be used for login, credential entry, or any financial or payment interaction. Read-only observation, if needed at all, should be done in an isolated environment, and nothing should be downloaded or submitted. Any link or message directing users here should be treated as hostile and reported.

Signals weighed against the site

• AbuseIPDB: 2 reports on hosting IP 2a05:d014:58f:6200::259 (Amazon Data Services Ireland Ltd, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.