Is votes-okxpolls-105.pages.dev a scam? 0/100

Security Alert

Fortinet flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

The assessed address is a free-hosting subdomain on the pages.dev platform. Its hostname combines the words "votes", "okx" and "polls" with a numeric suffix, which reads like a crypto-themed voting or polling page. When analysed, it returned only a security interstitial headed "Suspected Phishing". The page states that the site has been reported for potential phishing, and it carries no products, forms, navigation, legal pages or business content of its own. Its apparent purpose is therefore not demonstrable from the page. The surrounding signals are consistent with a short-lived lure of the kind used to harvest credentials or wallet access.

Scam/Impersonation Risk

Contradictory signals are present and weigh heavily. Multiple independent threat-intelligence engines classify the address as malicious or suspicious, including one tier-one security vendor. External blacklisting is confirmed, and the hosting platform's own protective layer has put the site behind a phishing warning. The hostname is also built to look like a polling or voting page connected to a well-known crypto exchange brand, hosted on a disposable subdomain rather than any brand-controlled domain. That is a common pattern in lures that ask visitors to "vote" or "claim" something by connecting a wallet or signing in. No explicit brand impersonation was confirmed in the page content, and no conflicting legal identities were observed, because the page presents no identity at all. The page-level analysis rates the content as high risk. It also flags a mismatch between what the site is presented as and what the evidence shows. Behavioural testing recorded heavy third-party request activity, a very large DOM change after interaction, repeated console errors, and a final destination that differed from the requested one. It classified the access gating as bot protection rather than deliberate cloaking. The behavioural tests found no wallet-connection attempts, clipboard hijacking, hidden forms or external password forms, but these were run against the interstitial, not the content it blocks. The site's real content therefore remains unassessed, and the absence of those behaviours cannot be read as reassurance. Evidence:

• Homepage: the only content retrieved is a "Suspected Phishing" warning stating the site "has been reported for potential phishing", with no site content behind it.
• Reputation: several independent threat-intelligence engines flag the address, and external blacklisting is confirmed.
• Hostname: a free-hosting subdomain embedding a crypto exchange keyword and a "polls" theme.
• Behavioural sandbox (3 runs): about 97% of requests were external, 1,508 DOM mutations followed interaction, there were 10 console errors, and the final destination did not match the requested one.

Regulatory Verification Notes

The page presents no legal, terms, privacy, about or contact pages, no company name, and no licence or registration claim. Because only a block page could be retrieved, no on-site disclosure can be evaluated, and the operator's real-world identity remains unverified. Ownership and governance are opaque. This is an opacity condition, not an identity contradiction, and it matters here only because it coincides with confirmed external threat detections. No third-party broker or regulatory-registry match was found for the site. This absence is neutral and does not constitute a regulatory finding. The site offers no financial service that could be matched against a licensing authority. Evidence:

• Homepage: no company name, legal entity, licence number or regulator reference is shown.
• Hosting: served from AS13335 (Cloudflare, Inc., US).
• Transport security: a domain-validated TLS certificate issued by YE2, valid to 2027-01-08. This confirms only an encrypted connection, not who operates the site.
• Broker intelligence: no match in the reputational dataset.

What to Verify Next

Any message, advertisement or social post that directed a visitor to this address should be traced to its origin. The address should be compared with the official domain and verified social channels of the exchange brand it alludes to, using routes the visitor already trusts and not links supplied in the message. Any official poll, vote or reward programme should be confirmed on the brand's own website or app. If credentials, seed phrases or wallet approvals have already been submitted here, the affected accounts should be secured and wallet permissions revoked. The address should also be reported to the hosting platform and the relevant anti-phishing channels. Official support or contact channels should be confirmed independently, not through anything on this site. Evidence:

• Homepage: the platform warning advises against entering credentials or sensitive data on the underlying site.
• Hostname: the brand-style keywords sit on a generic hosting subdomain, not a domain controlled by the brand.
• Registry check: no licensing or registration claim exists to confirm, so verification must rest on the brand's official channels.

Summary Verdict

The overall posture is high risk. Confirmed external threat detections, a platform-issued phishing warning, and adverse page and behavioural signals converge on a clearly adverse assessment. This outcome is driven by reputation and content evidence, and no sign of legitimacy offsets it. The operator's identity is unverified, and nothing available supports treating the site as a genuine voting or polling service.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and WAF, a mainstream and reputable provider, with many edge addresses and a couple of possible origin candidates observed. This shows only that the site is served through a well-run platform. It is a minor mitigating factor, and it does not establish legitimacy or offset the confirmed threat detections.

Closing Assessment

The site should not be used for login, credential entry, wallet connection or any financial interaction. Passive viewing should be limited to the warning page, and nothing should be downloaded or approved. Anyone who has already interacted with the site should treat related accounts and wallets as potentially exposed and act on that immediately.