Is pump-voting-wqg.netlify.app a scam? TrustSniffer's high-risk assessment: 0/100

Overview

This website is a subdomain on a public site-hosting platform, and its homepage currently serves only the platform's generic "Site not found" 404 page. The page tells the visitor that a broken link was followed or that the address does not exist on the platform. It offers an invitation to "build and deploy your own site for free", and shows no products, services, pricing, funding appeal or other commercial content, so no business model is visible. The subdomain label ("pump-voting") hints at a token-promotion or community-voting theme, but nothing on the page substantiates or explains that purpose.

Scam/Impersonation Risk

The assessment is clearly cautionary. A confirmed blacklist hit exists: an external threat-intelligence aggregation flags the address as both malicious and suspicious, and that listing is decisive. Separately, four abuse reports are recorded against a shared provider address in the site's hosting footprint. The reports attach to infrastructure shared with other tenants rather than to this subdomain alone, so they are an indirect, shared-environment signal that nonetheless remains unmitigated. Behavioural testing adds a second layer of concern. In all three sandbox runs the page concealed form elements, including password-type fields, and its structure changed very heavily after interaction, even though the visible page is a static error notice with no login or form. A visible page that shows nothing while concealed credential-capable forms and large content changes appear behind it is a recognised pattern for staged or swappable phishing content. A lookalike-brand signal was also raised against the hosting platform's own name, but no confirmed impersonation of a third-party brand or conflicting legal identity was found. The risk therefore rests on the blacklist listing and the concealed-form behaviour, not on a proven fraudulent storefront. Evidence:

• Homepage: a hosting-platform 404 notice with no commercial content, while the sandbox observed concealed forms with password fields in all 3 of 3 runs.
• Homepage behaviour: roughly 4,130 DOM mutations after interaction, with 36 external network requests against a static error page.
• Reputation: the external aggregation reports 1 malicious and 1 suspicious detection; 4 abuse reports were logged against the shared provider address (last reported about 27 days before analysis).
• Page analysis: a lookalike-brand flag against the hosting platform's name, with no confirmed third-party impersonation.

Regulatory Verification Notes

The site presents no legal, terms, privacy, about or contact pages, so no operator name, registered entity, licence or registration number is available to assess. The real-world operator therefore remains unconnected to any identifiable brand or person, and the site's ownership and governance are opaque in a way that matters here, because the site is also the subject of an external blacklist listing. The reputational listing is a hard negative signal in its own right. The site carries no claim of financial authorisation, so there is nothing to check against a regulator, but the absence of any disclosure means no accountable party can currently be identified. No broker-reputation record matches the site. Evidence:

• Homepage: no company name, licence, registration number or legal documentation appears on the only observable page.
• Hosting: served from AS16509 (AMAZON-02, Amazon.com, Inc., US) under the ARIN registry.
• Transport encryption: the TLS certificate is an OV certificate issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 to Netlify, Inc., valid to 2027-03-19. It belongs to the hosting platform and says nothing about the subdomain's operator.
• Broker-reputation dataset: no match.

What to Verify Next

The first step is to establish who controls this subdomain, by asking the party that supplied the link for their official, independently confirmed web address and comparing it character by character. Any message, advertisement or social post that directed a visitor here should be treated as unverified until its sender is confirmed through a separate, known-good channel. If the subdomain was promoted in connection with a token, vote or airdrop, the project's official channels should be checked offline for whether they reference this exact address. Security teams that encounter the address in internal logs should check whether any user submitted credentials or connected a wallet to it, and should report the address to the hosting platform's abuse desk. Evidence:

• Homepage: the page shows no operator identity or official contact route that could be used for validation.
• Behavioural testing: credential-capable form fields were concealed on the page, so any prior credential submission to this address warrants review.
• External listing: the address is flagged by an external threat-intelligence aggregation, which supports reporting it to the platform.

Summary Verdict

The site sits in a critical-risk posture. A confirmed external blacklist listing and concealed credential-capable behaviour outweigh the neutral, content-free page, and the operator's identity cannot be connected to any real-world party. The evidence supports a high-risk assessment without establishing a specific fraud scheme.

Infrastructure Integrity

The site is served through AWS-backed edge infrastructure on a major platform, behind a valid, mainstream-issued TLS certificate. All four observed addresses are edge nodes, and the origin server was not observable. This is a mitigating factor only: it shows the site is hosted on a reputable platform, but it does not vouch for the content or operator, and the shared nature of the edge environment is why the abuse reports cannot be attributed to this subdomain alone. Edge-only visibility also means content can be swapped quickly without any change in the observable hosting footprint, so the infrastructure cannot offset the reputation risk.

Closing Assessment

The address should not be used for login, credential entry, wallet connection or any payment or financial interaction. At most, it should be viewed passively from an isolated environment. Anyone who has already entered credentials or approved a wallet connection here should change the affected passwords and revoke the approvals immediately.

Signals weighed against the site

• AbuseIPDB: 4 reports on hosting IP 2a05:d014:58f:6200::258 (Amazon Data Services Ireland Ltd, Content Delivery Network), 1% confidence. The reports are attributed to shared infrastructure, not specifically to this website.