Is virtual-votings.pages.dev a scam? TrustSniffer's high-risk assessment: 12/100

Overview

This website is a single-page landing site, served under the name "virtual-votings" on a shared hosting subdomain, that presents itself as Virtuals Protocol, a platform for creating, co-owning and interacting with AI agents. It lists the ACP and GAME agentic frameworks, a venture fund (Virtuals Venture), a partner network and developer resources. Its main call to action is a "VIRTUAL Rewards Update" inviting token holders to vote on an upcoming rewards date, with early VIRTUAL allocations promised to voters from a treasury pool. The apparent business model is a token-centred crypto ecosystem in which value depends on token and agent economics that the page does not detail.

Scam/Impersonation Risk

Material contradictory signals are present, and the assessment is cautionary. Several independent threat-intelligence engines currently flag the site as malicious or suspicious, and an external blacklist listing is confirmed, so this is a confirmed blacklist hit and not a soft reputational concern. The hostname is a recently created, free-tier hosting subdomain that is lexically unrelated to the brand it displays. The page's own copyright line points to a different, branded domain. This mismatch is the classic profile of a lookalike deployment. A phishing association is also recorded in the site's history signals. The only call to action is a "Vote" prompt tied to an "early allocation" of tokens, which is a well-known lure for pushing holders towards wallet-connection or approval flows. The hostname itself uses the word "votings". The rewards mechanics are described only in passing, with no tokenomics, audit or legal-entity detail. No login form, hidden form, wallet-drainer behaviour or clipboard manipulation was observed in the sandbox runs. This does not offset the reputation findings, because a malicious payload can be swapped in after the observed sessions. No conflicting legal entities were found, so the risk rests on the blacklist and lookalike signals. Evidence:

• Homepage hostname: a hosting-platform subdomain, with about 30 days of observed history (first seen 2026-09-21), against a copyright line claiming a different branded domain.
• Threat-intelligence results: 3 engines rated the site malicious, 1 suspicious, and 57 harmless, alongside an external blacklist listing.
• Web archive: 1 snapshot, in 2026, covering 1 year tracked, so no established history exists to counterbalance the listings.
• Sandbox runs on the homepage: 9 console errors and 15 external XHR requests across 3 runs, with 3 requests to non-whitelisted destinations.

Regulatory Verification Notes

The homepage links Terms of Use, Privacy Policy and a "Launch Agreement". The visible page names no operating legal entity, jurisdiction or registration number. It claims no financial or digital-asset licence, and none could be verified. The lack of a named operator is ownership opacity. It is a disclosure limitation, not an identity contradiction, because no conflicting entity names appear. Crypto market data is attributed to a third-party aggregator, and the token contract is shown only in truncated form, so the page itself supports no independent check of what is being promoted. No third-party broker or regulator listing matched this site, so there is no external reputational signal on regulatory standing either way. Evidence:

• Homepage footer: links to legal documents, but no named company, address or licence reference.
• Hosting: the site is served from AS13335 (Cloudflare, US).
• Transport encryption: a domain-validated (DV) TLS certificate issued by WE1, valid to 2026-12-04. This confirms encrypted transport only and says nothing about the operator.

What to Verify Next

Before any interaction, confirm through an independent route, such as a bookmark made earlier or the project's officially announced channels, that this exact hostname is operated by the project it displays. Check separately whether any holder rewards vote has been announced by those official channels. Compare the token contract against an independent block explorer and market listing, because the page shows only a truncated address. Confirm the operating entity and any applicable authorisation through the relevant public registry only if an official source can first be established. Evidence:

• Homepage rewards banner: the vote and early-allocation offer exists only on this page, and no corroborating announcement is visible.
• Homepage token line: the contract appears as a truncated address next to a "Processing…" placeholder.
• Homepage footer: the copyright range and branded domain name differ from the serving hostname.

Summary Verdict

The deterministic assessment places the site in the critical-risk band, with a high-severity posture. Confirmed external threat detections are decisive, and no protective measure or cosmetic page quality can offset them. The site's content reads as polished, but its provenance fails and its identity is unverified. It is classed as unsuitable for any sensitive interaction.

Infrastructure Integrity

The site is fronted by a mainstream CDN/WAF provider, and all four resolved addresses are edge servers of that provider, so the origin host is not observable. This is a mitigating factor only, since it shows nothing about who operates the content. Edge-only visibility also prevents independent verification of the hosting and can mask rapid content swaps. The certificate is valid and from a known issuer, but encryption does not establish the legitimacy of the operator.

Closing Assessment

The site should be treated as unsafe for anything beyond passive viewing. No wallet connection, transaction signing, token approval, credential entry or payment should take place on it. Anyone who received a link to it should reach the project only through an independently sourced official channel and report the link to that project.