Is votes-alignedlayer.live a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

The domain votes-alignedlayer.live is a newly registered website on the ".live" top-level domain. Its name suggests a voting or governance portal tied to an "aligned layer" blockchain-style project. When the site was visited, it did not show a normal homepage. It returned a security interstitial titled as a suspected phishing page, and no product pages, legal pages or business description were available to review. Its apparent purpose therefore cannot be established from the site itself. The naming pattern fits a campaign-style or lure domain, and no independent evidence connects it to a real organisation.

Scam/Impersonation Risk

This is the decisive area of the assessment. Several major security vendors currently flag the domain as malicious or suspicious, and it is confirmed as blacklisted by external threat-intelligence sources. Those sources also hold prior phishing intelligence against it. This is a confirmed adverse reputation, not a soft signal. No conflicting legal entities and no direct brand-impersonation finding were recorded. The risk comes from the threat listings and from the behaviour of a domain this new, not from contradictory identity claims. The browser sandbox did not observe wallet-connection prompts, clipboard tampering, hidden forms or credential posts to outside parties. This does not offset the listings, because a page that serves a warning interstitial may not reveal its full behaviour to automated visitors. The page showed heavy external communication, a sharp burst of page-structure changes after interaction, and repeated script errors, which is consistent with unstable or hurriedly assembled content. Overall, the evidence supports treating the site as a probable phishing or credential-harvesting vehicle. Evidence:

• Homepage: the page served to the automated visitor was a security warning interstitial titled as suspected phishing, with no legitimate business content behind it.
• Domain registration: registered 2026-08-18, about 0.19 years (~68 days) old, so there is no established operating history.
• Homepage behaviour: 64 external XHR/fetch calls and 9 external POST requests across three runs, with external traffic reaching about 97% in the busiest run.
• Homepage behaviour: 22 console errors and 1,518 DOM mutations after interaction, indicating unstable page behaviour.

Regulatory Verification Notes

No licence, registration number, corporate name, terms page or privacy page could be associated with this domain. This is a verification matter and not proof of wrongdoing on its own. Ownership opacity is present, because the registrant details are incomplete. This is not treated as an identity contradiction, but it removes any means of tying the domain to an accountable operator. No third-party broker or regulator record matched the domain, so there is no outside reputational context that could mitigate the confirmed threat listings. Any claim of regulated or project-affiliated status made by this site, or by messages pointing to it, should be treated as unsubstantiated. Evidence:

• Domain registration: registered through NICENIC International Group Co., Limited; registration runs to 2027-08-18 and was created 2026-08-18 (~0.19 years).
• Hosting: served from AS13335 (Cloudflare, Inc., US).
• Transport encryption: the TLS certificate is a domain-validated (DV) certificate issued by WE1, valid to 2027-01-15. This confirms encryption only and says nothing about operator legitimacy.
• Third-party reputation: no broker or regulatory-dataset match was found for the domain.

What to Verify Next

Anyone who reached this domain through a link, message or advertisement should confirm the official channel of the project it claims to represent. They should do this independently, by typing the project's known address themselves or using an offline or previously trusted route, and not by following the link. The same applies to any announcement of a vote, allocation or claim that referenced this domain. Anyone who has already entered credentials, a seed phrase or wallet approvals on the site should treat those secrets as compromised. They should change passwords, revoke token approvals and move assets to a fresh wallet. Organisations should block the domain and report it to their security team and to the relevant abuse channels. Evidence:

• Homepage: the interstitial and the cluster of security-vendor detections both point to phishing activity associated with this domain.
• Domain registration: the domain is only a few months old, so no earlier legitimate use can be assumed.
• Behavioural sandbox: three of three runs completed, but the post-interaction page changes were extensive enough that content could differ for real visitors.

Summary Verdict

The available evidence places this domain in a clearly high-risk posture. Active threat listings, a very recent registration and the absence of any verifiable operator point to a hostile or deceptive site, not a legitimate service. Technical hygiene such as valid encryption does not change that conclusion.

Infrastructure Integrity

The site is fronted by Cloudflare, and all four observed addresses are shared edge servers in the United States. The real origin server was not observable. Cloudflare's presence mitigates direct exposure of the host, but it also prevents independent verification of where the content actually lives. The same shared infrastructure serves many unrelated sites, so it says nothing about this operator's legitimacy. It is treated as a limited mitigating factor that cannot offset the confirmed threat listings.

Closing Assessment

The domain should not be used for login, wallet connection, credential entry or any financial interaction. Even passive browsing should be limited to isolated, security-controlled environments for analysis. Organisations should block it at the network or email gateway and report it, and individuals should disengage from any message that directed them to it.