Is vote-lightersxyz-com.pages.dev a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a single-page deployment on a free, shared web-hosting subdomain. Its hostname is built around a vote-themed label and a different-looking ".xyz" domain string. The page presented to automated visitors was an access-challenge screen, not branded content. Its apparent purpose cannot be established from the captured material, but the naming pattern is typical of short-lived campaign or lookalike pages that steer visitors toward voting, claiming or onboarding actions.

Scam/Impersonation Risk

The evidence converges on an elevated risk of malicious use. Several independent security engines currently flag the site, including a tier-one security vendor, and the aggregate result amounts to a confirmed blacklist listing. Where the page could be captured, the site's content-delivery provider showed a "suspected phishing" interstitial, which independently corroborates the engine detections. The hostname embeds a separate domain-style string inside a shared-hosting subdomain. That structure is commonly used to imitate another property, although no specific brand or legal entity impersonation was confirmed and no conflicting legal identities were observed. Sandbox testing showed no wallet-connection prompts, clipboard tampering, hidden forms or credential posts to outside parties. That absence does not offset the reputational findings. The page also rebuilt large portions of itself after interaction and generated repeated script errors, and nearly all of its network traffic went to third-party services. The behaviour is consistent with a dynamic front end that could be changed quickly to introduce credential or onboarding flows. Evidence:

• Homepage capture: the page was held behind a bot challenge (HTTP 403) and displayed a "Suspected Phishing" warning, with only a very small amount of text available.
• Reputation checks: six security engines rated the site malicious and two rated it suspicious, including a tier-one vendor. A confirmed blacklist signal is active.
• Domain provenance: the domain was registered in 2026 and is about 37 days old (~0.1 years).
• Web archive: 2 snapshots in total, between 2026-09-14 and 2026-09-17 (1 year tracked), so there is no meaningful independent history.
• Homepage behaviour: 54 outside XHR/fetch calls and 5 outside POST requests, all to recognised services. There were 1,503 page mutations after interaction and 12 console errors across three sandbox runs.

Regulatory Verification Notes

The captured page exposed no legal, terms, privacy or about content. It identifies no operating company, licence or registration number, and its governance and ownership are opaque. This is a disclosure gap only. It is not evidence of wrongdoing in itself, but here it sits beside confirmed reputational detections, so it cannot be treated as an administrative detail. No third-party broker or regulatory-database record matched this site, so no external signal supports any claim of authorisation. The transport encryption is valid, but it is only domain-validated. It proves that the connection is encrypted and says nothing about who operates the site. Evidence:

• Homepage and navigation: no company name, licence reference, registration number or contact disclosure was observable in the captured content.
• Transport encryption: TLS certificate issued by WE1 (DV, domain validation only), valid to 2026-12-04.
• Hosting: served from AS13335 (CLOUDFLARENET - Cloudflare, Inc., US).
• Broker and regulator databases: no matching record was found.

What to Verify Next

Anyone who reached this address through a message, advertisement, social post or QR code should treat that source as suspect. They should confirm the official address of the project or organisation the page claims to represent through an independent route, such as a known official website typed manually, a verified social profile or printed material. They should confirm the official support and contact channels the same way. If the page asked for any wallet connection, signature, vote or login, they should stop and not proceed. Anyone who has already interacted should review recent account and wallet activity and revoke any permissions granted. The site should be re-checked only after the security listings have been formally cleared by the listing vendors. Evidence:

• Hostname: a shared-hosting subdomain with an embedded domain-style string, which cannot be treated as an official or branded address.
• Current listings: multiple active detections remain unresolved as of this assessment.
• Domain age: registered in 2026 with no established history, so no prior legitimate use can be inferred.

Summary Verdict

The overall posture is high-risk and clearly cautionary. The site is very new and has no verifiable operator, and several independent security sources currently flag it as malicious. The technical hygiene the site does display is routine and cannot offset those findings.

Infrastructure Integrity

The site sits behind a mainstream CDN/WAF provider, and all observed addresses are edge servers, so the origin host could not be seen. That protection is a mitigating factor only. It shows the site uses a reputable network and has bot filtering. It does not vouch for the operator or the content, and it hides the underlying host from independent verification. The edge-only view also means the content could be replaced rapidly without any visible change in hosting.

Closing Assessment

Treat the site as unsafe for any interaction beyond passive viewing, and avoid logging in, connecting a wallet, signing transactions, entering credentials, making payments or downloading files from it. If the page was reached through an unsolicited link, it should be reported to the platform where it was found and to the hosting provider's abuse channel.