Is pump-voting-3v.netlify.app safe? TrustSniffer's low-trust assessment: 25/100

Overview

This website is a bare "Site not found" 404 placeholder served from a free subdomain on the Netlify hosting platform. It carries a name that reads like a token-voting or "pump" campaign. A visitor sees only a broken-link message pointing to Netlify's support guide and an invitation to start building a site. It shows no products, pricing, contact details or legal content, so its purpose and business model cannot be determined from what it displays.

Scam/Impersonation Risk

The assessment rests on external threat reputation and on runtime behaviour that contradicts the static page. The domain is blacklisted by an external threat-intelligence source. One engine in a multi-engine reputation aggregation rates it malicious and another rates it suspicious. This is the decisive contradiction and it calls for a cautionary posture. No conflicting legal identities were found, and the analysis did not confirm a specific phishing campaign or brand impersonation. The hostname does closely resemble the hosting platform's own domain, which raised a brand-lookalike flag, but the analysis did not confirm it. The more troubling pattern is behavioural. The visible page is an inert error screen with no forms and no login. Yet across all three sandbox runs the page exposed hidden forms, including password-type fields. It also produced very heavy DOM mutation after interaction, and about thirty-six external network requests, almost all to third-party destinations. Embedded advertising, analytics and tracking-pixel components were also detected. An error page should not carry any of this, so the page may be a dormant or staged shell that can be swapped for credential-collecting content. The sandbox did not observe wallet-draining, clipboard hijacking, cloaking, or form submissions to untrusted destinations. Separately, four abuse reports exist against a shared provider IP address that serves this site. Those reports are attributed to shared infrastructure and do not by themselves implicate the site's operator. Evidence:

• Homepage: a Netlify "Site not found" placeholder of about 368 characters, with no forms, links, offers or business content visible.
• Sandbox behaviour on the homepage: hidden forms and password-type fields detected in 3 of 3 runs, with 4,130 DOM mutations after interaction and a maximum of 99.6% external request share.
• Threat reputation: 1 malicious and 1 suspicious detection in the multi-engine aggregation, alongside an external blacklist hit.
• Hosting IP: 4 abuse reports against a shared provider address, attributed to shared infrastructure and not discounted.

Regulatory Verification Notes

The site carries no legal, about or terms pages, claims no license or regulator, and names no operating entity, so no real-world operator identity can be tied to it. These are disclosure gaps in an empty page and are not proof of fraud. In this case they sit alongside the confirmed reputation contradictions, so they cannot offset those findings. No third-party broker profile matched the domain. The valid, organisation-validated certificate is issued to the hosting platform and not to any independent operator. It confirms encrypted transport to Netlify's infrastructure and says nothing about who controls this subdomain's content. Evidence:

• Homepage: no company name, license number, regulator reference, legal terms or privacy policy appears.
• Hosting: served from AS16509 (AMAZON-02 - Amazon.com, Inc., US).
• Transport encryption: TLS certificate issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 (OV), subject organisation Netlify, Inc, valid to 2027-03-19.

What to Verify Next

Any approach to this site should start with where the link came from. A message, advertisement or social post pointing to a "voting" or "pump" page on a free hosting subdomain should be traced back to its sender through an independent channel. The claimed project or organisation should be matched against its official website and verified social accounts, reached without using this link. Because the page can currently display nothing but an error, any later appearance of login, wallet-connection or payment prompts at this address should be treated as a new, unvetted event and re-assessed from scratch. Contact and support channels should be confirmed only through official sources. A claimed project that cites a license or registration should be checked directly in the relevant registry. Evidence:

• Homepage: no identifiable project, operator or call to action is presented to anchor the site to any real-world claim.
• Hidden forms and password fields in the page's runtime behaviour show that its content may change without notice.
• Hostname: a free platform subdomain that anyone can register, so the hostname carries no independent credibility.

Summary Verdict

The site sits in an elevated-risk posture. A confirmed external blacklisting and concealed form behaviour on a page that presents no business purpose point in the same direction. The platform's valid transport security and mainstream hosting do not offset this reputational and behavioural evidence. Legitimacy cannot be inferred, and the real-world operator remains unidentified.

Infrastructure Integrity

The site resolves to four addresses, all on Amazon's network and all edge-layer addresses. Netlify's AWS-backed delivery layer sits in front of the site, so the origin server is not observable. This is a mitigating factor for availability and baseline exposure. It also prevents independent verification of where content is actually hosted, and it allows content to be replaced quickly without any visible change in the infrastructure. It does not establish legitimacy.

Closing Assessment

Use should be limited to passive, read-only viewing at most. No login, credential entry, wallet connection, payment or financial interaction should take place, and nothing should be downloaded from the site, until the operator is independently identified and the external reputation findings are resolved.

Signals weighed against the site

• AbuseIPDB: 4 reports on hosting IP 2a05:d014:58f:6200::258 (Amazon Data Services Ireland Ltd, Content Delivery Network), 1% confidence. The reports are attributed to shared infrastructure, not specifically to this website.