Is pump-voting-r1.netlify.app a scam? 5/100

Overview

This website is a subdomain on Netlify's shared hosting platform. It currently serves only the platform's generic "Site not found" error page, which tells the visitor that the requested address does not exist and offers hosting-support troubleshooting links. The page carries no products, offers, pricing, branding or stated business model, so the site's purpose can only be inferred from the address, which suggests a voting or promotion-themed project in the crypto "pump" vernacular. In practice it is an unpopulated placeholder address with no verifiable operator.

Scam/Impersonation Risk

The contradictory signals are serious and are the reason for a clearly cautionary posture. A threat-intelligence feed currently lists this domain as an active distributor of phishing content. The most recent listing was observed the day before this analysis, and the listing is decisive. The domain is also on an external blacklist, with one reputation engine rating it malicious and another rating it suspicious. The sandbox behaviour reinforces this. The visible page is a static error screen with no forms, but in every run the sandbox detected hidden forms and password-type form elements. After interaction the page's structure changed on a very large scale, which a static 404 would not produce. The sandbox also flagged a mismatch between the requested and final destination. This pattern is consistent with a placeholder that can swap in credential-harvesting content or redirect traffic, so the clean-looking error page should not be read as reassurance. Four abuse reports exist against one of the shared edge addresses the site resolves to. They apply to shared provider infrastructure rather than to this domain specifically, so they are corroborating background only and not independent proof. No brand impersonation and no conflicting legal identities were observed, and the weight of the assessment rests on the phishing listing and the blacklist. Evidence:

• Homepage: only a "Site not found" notice with a hosting-platform troubleshooting link and a "Start building" prompt, with no content, claims, or contact details.
• Sandbox: hidden forms were detected in all 3 runs, with password-form elements present. DOM mutations reached 4,132 after interaction.
• Threat feed: an active phishing-class listing was last seen on 2026-10-18.
• Reputation sources: 1 malicious and 1 suspicious detection. Of the 4 abuse reports, the latest was filed 25 days before analysis.

Regulatory Verification Notes

The site presents no legal, identity, licensing or regulatory pages. It makes no claim to any license, registration or regulated status, so there is nothing on the site to test against a registry, and the absence of disclosure leaves no content on which any legitimacy could rest. The valid, organisation-validated TLS certificate identifies the hosting platform as its subject, not the operator of this subdomain. It confirms encrypted transport only and says nothing about who runs the site. The broker-reputation lookup returned no match, which is neutral context and not a regulatory finding. Identity remains unverified, and the evidence does not support describing the operator as a legitimate or regulated business. Evidence:

• Homepage: no company name, license number, terms, privacy policy or contact page is presented.
• Transport encryption: the certificate was issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 (OV) to Netlify, Inc, valid to 2027-03-19.
• Hosting: served from AS16509 (AMAZON-02 - Amazon.com, Inc., US).
• Broker-reputation dataset: no match for this domain.

What to Verify Next

No one should interact with this address until the phishing listing is cleared. A party who believes they own the address should audit their Netlify account for unauthorised deployments, form handlers and redirect rules, then remove any unrecognised content. They should also rotate credentials and tokens linked to that account. Anyone who received this link as a voting, promotion or token-related invitation should confirm through an independent route, such as the project's officially published channels reached by manual navigation, whether the address is genuine. Any credentials or wallet details already entered through it should be treated as exposed. The listing status should be re-checked after any remediation before the address is treated as safe again. Evidence:

• Threat feed: the phishing-class listing was current as of 2026-10-18.
• Sandbox: hidden password-capable forms recurred in all 3 runs on a page that visibly shows only an error notice.
• Homepage: no official contact route or project identity is published for independent confirmation.

Summary Verdict

The evidence supports an elevated-risk posture. Current third-party threat detections and the sandbox's anomalous behaviour outweigh the valid encryption and mainstream hosting. The operator is unidentified, and nothing on the site offsets the adverse listing. The domain should be treated as a probable credential-harvesting or phishing vector until the evidence changes.

Infrastructure Integrity

The site resolves entirely to content-delivery edge addresses on a major cloud provider. The origin server was not observable, so hosting cannot be independently attributed beyond the shared platform. The subdomain sits on infrastructure used by many unrelated tenants. This is a mitigating factor only: it explains why the abuse reports are attributed to shared infrastructure, but it cannot offset the active threat listing or the sandbox findings.

Closing Assessment

The address should not be used for login, credential entry, wallet connection or any financial interaction, and nothing should be downloaded from it. Any link that directs traffic here should be treated as suspect and reported to the hosting platform's abuse channel, and the domain should be re-assessed only after the listing has been removed.

Signals weighed against the site

• AbuseIPDB: 4 reports on hosting IP 2a05:d014:58f:6200::258 (Amazon Data Services Ireland Ltd, Content Delivery Network), 1% confidence. The reports are attributed to shared infrastructure, not specifically to this website.