Is pump-voting-g5.netlify.app a scam? 5/100

Overview

The website is an unconfigured Netlify-hosted subdomain whose hostname suggests a voting-themed destination. The only content visible to a visitor is a generic "Site not found" error page saying the link is broken or the site does not exist on Netlify, with a prompt to "Start building" and a support-guide pointer. It shows no products, pricing, forms or stated business model, so its apparent purpose is a placeholder or an abandoned deployment. Independent threat-intelligence data nonetheless points to active malicious use of the domain.

Scam/Impersonation Risk

A threat-intelligence feed currently lists this domain as distributing phishing, and the listing was most recently observed on 18 October 2026. The domain is the actor in that listing, not a bystander on a compromised host, and this is the decisive factor in the assessment. A separate external reputation check also blacklists the domain, with one engine rating it malicious and another suspicious. The visible page cannot be taken as reassurance. It is a benign hosting error page, and it contains no credential prompt, no brand imitation and no solicitation. A bare error page is, however, what a phishing kit can show to scanners, or what a deployment shows while its payload is inactive or has been removed. The behavioral sandbox found hidden forms in all three runs, including password-type fields. Roughly 99.6 percent of requests on one page load went to external destinations. Interaction produced very large page rewrites, and the final destination did not match the requested one. The destinations contacted were all on trusted lists and no wallet-drainer or clipboard-hijack behavior was seen. The static page capture shows no forms at all, so the hidden credential-capable forms appear only at runtime. Two abuse reports exist against a shared cloud IP address. They are discounted because that address is shared provider infrastructure, and they do not indicate misconduct by this site. No brand impersonation and no conflicting legal identities were observed, so the elevated risk rests on the phishing listing and the blacklist and not on identity contradictions. Evidence:

• Homepage: a standard hosting-provider 404 page of about 368 characters of text, with no visible forms, links or solicitations.
• Threat-intelligence listing: class phishing, role actor, most recent sighting 2026-10-18.
• Sandbox behavior across 3 of 3 runs: hidden forms detected, 3 password forms recorded, 4,132 page mutations after interaction, 15 external XHR calls and 21 external POSTs, all to whitelisted destinations.
• Sandbox: no wallet-connection, clipboard-hijack or fingerprinting activity.

Regulatory Verification Notes

The only page analysed carries no legal entity name, terms, privacy policy, licence or registration claim, and no regulator is cited. Independent identity verification is therefore not established. Operator ownership cannot be connected to any real-world brand or person from on-site evidence. This is a verification gap and not proof of wrongdoing, and the phishing listing and blacklist already supply the contradictory evidence. No third-party broker or regulatory record matched this domain. Absence from such datasets is neutral and gives neither support nor cause for concern. The hosting address belongs to a mainstream cloud provider, and the site has a valid organisation-validated TLS certificate. Both are facts about the shared Netlify platform and say nothing about whoever controls this subdomain. Evidence:

• Homepage: no company name, licence number, regulator, address or contact channel is published.
• Hosting: served from AS16509 (AMAZON-02, Amazon.com, Inc., US).
• Transport encryption: the TLS certificate was issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 at OV level, subject organisation Netlify, Inc, valid to 2027-03-19.
• No third-party broker or regulator database entry matched the domain.

What to Verify Next

Anyone who reached this address through a message, advertisement, social post or QR code should trace how the link was obtained and treat that source as suspect until it is confirmed through an independent route. If the link claims to represent a project, community or voting event, contact that organisation through an official channel found independently of the link and ask whether the address is theirs. The listing status should be re-checked before any later reassessment, because phishing infrastructure is often rotated or taken down quickly. Suspected abuse can be reported to the hosting platform's abuse process, and the sender or originating account can be reported on the platform where the link appeared. Evidence:

• Hostname: a voting-themed label on a shared free-hosting subdomain, with no independent link to an established organisation.
• Listing: the phishing designation was current as of the latest sighting on 2026-10-18.
• Homepage: no official contact route is published, so any outreach has to go through an independent channel.

Summary Verdict

The assessment is critically low and the posture is clearly cautionary. A current phishing listing and a blacklist outweigh the benign appearance of the visible page. Identity is unverified, and nothing observed offsets the active threat designation.

Infrastructure Integrity

The domain resolves behind a CDN/WAF layer. Cloudflare edge addresses on AS13335 were observed, and the hosting record is AS16509 (Amazon). All eight observed addresses were edge nodes and no origin address was observable. This is protective, mainstream infrastructure and a mitigating factor only. It does not offset the active threat listing, and shared platforms such as this are routinely used by both legitimate and malicious tenants.

Closing Assessment

This address should not be used for login, credential entry, wallet connection or any payment. The most that is reasonable is passive viewing with no data submitted. Anyone who has already entered credentials or connected a wallet should change those passwords and revoke wallet permissions immediately.

Signals weighed against the site

• AbuseIPDB: 2 reports on hosting IP 2a05:d014:58f:6200::259 (Amazon Data Services Ireland Ltd, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.