Verdict
Several risk patterns were present. Do not send money or personal details until you have verified this business another way.
pump-voting-9s.netlify.app is low-trust and potentially risky.
| What this site appears to be | The page displays a Netlify 'Site not found' 404 error, indicating the requested path or site does not exist on the Netlify hosting platform. It contains no service description, offer, or interactive elements. |
|---|
Evidence status and limitations
Evidence completeness: Not recorded
- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.
At a glance
The checks that decide most of this verdict.
| Malware engines | 2 flagged itVirusTotal | Risk |
|---|---|---|
| Google Safe Browsing | Not listedGoogle | Clear |
| Abuse reports on the host | 0% confidenceAbuseIPDB, 2 reports; shared hosting inflates reports | Clear |
| Domain age | Not availableNo registration record was returned | Noted |
| Web archive | Never archivedNo public history of this site | Watch |
| Certificate | Encrypted connectionIssued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 | Noted |
The page as captured
Key findings
- Automated classification: Sensitive Interaction Risk.
- At least one reputation service TrustSniffer consulted had flagged this domain at assessment time.
- The operator behind the site could not be independently connected to a real-world brand or person.
Full analysis
Overview
This website is a subdomain on the Netlify hosting platform. Its hostname suggests a token-voting or "pump"-themed service, but the page it serves is only Netlify's generic "Site not found" 404 placeholder. A visitor sees no product, service, pricing, contact details, or legal identity. The business model and purpose cannot be inferred from what the page shows.
Scam/Impersonation Risk
Confirmed contradictions are present. Multiple independent threat-intelligence engines flag the domain as malicious or suspicious, and an external blacklist listing is active, so the site is blacklisted by third-party reputation sources. This is decisive. The hostname is also a near-exact lookalike of the hosting platform's own brand, and the page analysis flags it as a suspected brand-impersonation pattern. That flag is a suspicion, not a confirmed impersonation. The visible page and the observed behavior also do not match. The visible content is a bare 404 error with no forms, yet the behavioral sandbox detected concealed forms in every run, including password-type fields. It also recorded very heavy page restructuring after interaction and an almost entirely external request profile. A hidden credential-capture surface behind an innocuous error shell is a recognised pattern for staged phishing infrastructure. Two abuse reports exist against one of the shared edge addresses, but they relate to shared provider infrastructure and are discounted. They are not attributed to this site. Contradictions between legal identities were not observed, because the page names no entity at all.
- Homepage: the content is a platform 404 notice with no visible form, offer, or contact route, yet concealed forms were detected in all three sandbox runs.
- Homepage behavior: a peak of about 4,130 page mutations after interaction, with external traffic reaching roughly 99.6% of requests in the peak run.
- Reputation: two engines rate the domain malicious and one suspicious, and an external blacklist listing is confirmed.
- Hostname: it closely resembles the hosting platform's brand, and the page analysis rates this suspected impersonation as high-confidence.
Regulatory Verification Notes
The site presents no legal pages, terms, privacy policy, licence, registration number, or named operator, so there is no on-site identity material to assess. The real-world operator remains unverified. The site makes no regulated-activity claim, and no broker-reputation record matched it. Reputational concerns therefore rest on the threat-intelligence signals above, not on any licensing assertion. The valid OV-level transport certificate identifies the hosting platform as its subject organisation. It confirms the platform's identity, not that of whoever operates this subdomain.
- Homepage: the page names no company, address, licence, or registration number, and no legal-notice or terms page is reachable.
- Transport encryption: the TLS certificate is issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 (OV), subject organisation Netlify, Inc, valid to 2027-03-19.
- Hosting: the site is served from AS16509 (AMAZON-02 - Amazon.com, Inc., US).
What to Verify Next
Anyone who received this link should first confirm, through an independent offline route, who sent it and what service it was meant to reach. The sender should also be asked to name the official, standalone address of that service. Any claim of a token-voting or related service should be checked against channels the claimant's brand publishes independently, not against this hostname. Because the hostname can be repointed to different content at any time, the address should be re-assessed before any later reliance on it. Anyone encountering it in unsolicited messages may report it to the hosting platform's abuse channel.
- Homepage: no official contact, product, or operator information is available to authenticate against.
- Behavioral capture: concealed password-type forms were observed on a page that visibly offers no login.
- Reputation: the active third-party listings mean any promotional message pointing to this address should be treated as unsolicited until proven otherwise.
Summary Verdict
The site sits in a clearly elevated-risk posture. The confirmed third-party listings and the mismatch between its innocuous visible face and its concealed form behavior outweigh the technical hygiene signals that would otherwise be neutral. Its apparent legitimacy cannot be established, and the available evidence is consistent with disposable or staged infrastructure.
Infrastructure Integrity
The site is delivered through an AWS-based CDN/WAF, and all observed addresses are provider edge nodes on a recognised, trusted provider. No origin server was observable. This is a mitigating factor only. Edge-only visibility prevents independent verification of the true host and can mask rapid content swaps. The infrastructure's quality cannot offset the confirmed reputation risk.
Closing Assessment
The site should be treated as unsafe for any login, credential entry, wallet interaction, or payment, and passive viewing is the only reasonable use. Links to it received through messages or social channels should not be followed or forwarded. Anyone who has already entered credentials here should change them immediately and enable multi-factor authentication.
Written analysis generated 2026-10-21 by the TrustSniffer Analysis Engine from the evidence in this report.
What the analysis found
3 findings contributed to this verdict, raised by external reputation, behaviour in a sandbox, page content.
01 External reputation
- Several malware engines flagged this domain.External reputation
rule:EXT_BLACKLIST_HIGH
02 Behaviour in a sandbox
- The page contained a form a visitor cannot see.Behaviour in a sandbox
rule:BEHAV_HIDDEN_FORMS - The page replaced a large part of its own content after loading.Behaviour in a sandbox
rule:BEHAV_DOM_CHANGE_HIGH - The page rewrote itself after it was interacted with, so what a visitor first sees is not what they end up on.Behaviour in a sandbox
rule:BEHAV_DOM_DIFF_AFTER_INTERACTION
03 Page content
- The page appears to present itself as a known brand it is not verified to belong to.Page content
rule:PAGE_BRAND_SUSPECTED
Signals weighed against the site
- AbuseIPDB: 2 reports on hosting IP 2a05:d014:58f:6200::259 (Amazon Data Services Ireland Ltd, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.
Identity verification
| Status | UNVERIFIED |
|---|---|
| Identity score | 30/100 |
| Identity verification confidence | 50% |
- No on-site identity signals detected
Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence.
What TrustSniffer observed
First-party facts recorded during the assessment of pump-voting-9s.netlify.app.
- The request stayed on pump-voting-9s.netlify.app. It was not redirected to another domain. Clear
- It is hosted on AMAZON-02, from a server in US. Noted
Domain intelligence
| Registrar | Not available |
|---|---|
| Hosting | AMAZON-02 - Amazon.com, Inc., US |
| Country | US |
| Server IP | 2a05:d014:58f:6200::259 |
| Name servers | Not available |
| CDN / edge network | Detected (aws) |
| Resolved IP addresses | 4 |
| Edge IP addresses | 4 |
| Likely origin IP addresses | 0 |
| SSL issuer | DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
| SSL expiry | 2027-03-19 |
| Domain age | Not available (no registration date was returned) |
| Domain expiry | Not available |
| Archive first seen | Not available |
| Archive snapshots | 0 |
| Reputation | VirusTotal: 2 flagged | AbuseIPDB: 0% confidence, 2 reports | Google Safe Browsing: 0 matches |
About this assessment
A trust score summarises the evidence TrustSniffer could collect about pump-voting-9s.netlify.app at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.
TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.