Verdict
This assessment found strong scam indicators. Do not pay, sign in, or share personal details with this site.
votes-virtualagent-21.pages.dev shows high-risk / scam indicators.
| What this site appears to be | The captured page is a Cloudflare 'Suspected Phishing' warning. It states that the site was reported for potential phishing and shows a Ray ID and the visitor's IP with a cookies prompt. It contains no login form, product, or service content, so the destination's purpose and legitimacy cannot be assessed from it. |
|---|
Evidence status and limitations
Evidence completeness: Not recorded
- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.
At a glance
The checks that decide most of this verdict.
| Malware engines | 3 flagged itVirusTotal | Risk |
|---|---|---|
| Google Safe Browsing | Listed as unsafeGoogle | Risk |
| Abuse reports on the host | 0% confidenceAbuseIPDB, 0 reports; shared hosting inflates reports | Clear |
| Domain age | Not availableNo registration record was returned | Noted |
| Certificate | Encrypted connectionIssued by YE2 | Noted |
| Hosted by | CLOUDFLARENETServer in US | Noted |
The page as captured
Key findings
- Automated classification: Sensitive Interaction Risk.
- At least one reputation service TrustSniffer consulted had flagged this domain at assessment time.
- The operator behind the site could not be independently connected to a real-world brand or person.
Full analysis
Security Alert
Google flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.
The captured page for this address, a subdomain on a shared developer-hosting platform, is not a business website. It is a security interstitial warning that the requested destination "has been reported for potential phishing." It contains no products, services, forms, login fields, or brand content of its own, so the operator's purpose and business model cannot be determined from what was captured. The site's only observable function is as a flagged destination that the edge network is blocking.
Scam/Impersonation Risk
Multiple independent reputation sources converge on this destination, so it is blacklisted. A major browser-security feed classifies it under the social-engineering threat category, several additional security engines flag it as malicious or suspicious, and a separate external blacklist confirmation is present. The edge network also placed a suspected-phishing warning in front of the site. This is an active, confirmed contradiction, and it is decisive for the risk posture. The destination's name is a generic, auto-generated-looking subdomain on a free hosting namespace. Such subdomains are cheap to create, disposable, and commonly reused for credential-harvesting pages. The captured page showed no login form, hidden form, wallet-connection routine, or clipboard manipulation. That does not clear the destination, because the interstitial prevented the underlying content from being observed. During automated sessions the page also generated a large share of external requests and a high volume of console errors, which is consistent with a gated, unstable, or poorly maintained front end. No conflicting legal identities were observed.
- The homepage capture shows the edge network's suspected-phishing warning, with no destination content visible.
- External reputation checks returned a social-engineering classification from a major browser-security feed, three malicious and one suspicious verdicts from other engines, and a confirmed external blacklist hit.
- Automated browsing across three runs recorded 12 console errors and about 87% external traffic share at peak, and the page capture was blocked by a bot challenge (HTTP 403).
Regulatory Verification Notes
No licence, registration number, legal entity, or terms page could be assessed. The only content captured is the warning interstitial, so licensing status and disclosure transparency cannot be evaluated and no regulatory standing can be inferred. No third-party broker or regulator profile matched this destination. The operator's real-world identity is unverified, and nothing on the captured page connects the site to an identifiable company or individual. A valid transport certificate is present, but it is domain-validated only and confirms encryption, not operator legitimacy.
- TLS certificate issued by YE2 (DV), valid to 2027-01-04, with subject alternative names present.
- Served from AS13335 (Cloudflare, Inc., US).
- The homepage capture contains 381 characters of text, no legal, about, or contact content, and no meta description.
What to Verify Next
Any prospective engagement should begin by confirming the site's status with the platform operator and the browser-security feed. Whoever relies on this address should establish whether the warning has been remediated or is still active. If a business relationship is claimed, the counterparty should be identified through an independent, offline route, such as an existing contract, a known phone number, or the organisation's officially published domain. Communications, payment instructions, or links received from this address should be rejected until that is done. Any official support channel should be confirmed through the same independent route.
- The homepage capture shows no content to authenticate against any known organisation.
- Reputation findings are current at the time of analysis and may change if the owner removes the content or the listing is reviewed.
- The destination's only visible content is an access-control warning, so no business claim exists to verify on-page.
Summary Verdict
The assessment is a high-risk, clearly cautionary posture. Confirmed external threat detections outweigh every technical positive, and the destination cannot be treated as trustworthy. The apparent legitimacy that a valid certificate and mainstream hosting might otherwise suggest is not supported by any content, identity, or reputation evidence.
Infrastructure Integrity
The destination sits behind Cloudflare's CDN and WAF. All four observed addresses are edge servers, and the origin address was not observable, so hosting cannot be independently verified. The protection is a mitigating factor only. It does not offset the external threat detections, and the same edge layer can mask rapid content swaps.
Closing Assessment
Do not log in, enter credentials, make payments, connect a wallet, or download files from this destination. If the address must be examined at all, it should be done read-only from an isolated environment, and no action should be taken on it until the warning is demonstrably lifted.
Written analysis generated 2026-10-20 by the TrustSniffer Analysis Engine from the evidence in this report.
What the analysis found
3 findings contributed to this verdict, raised by external reputation, page content, behaviour in a sandbox.
01 External reputation
- An external threat feed lists this domain: either Google Safe Browsing marked it malicious, or a significant number of malware engines flagged it.External reputation
rule:EXT_BLACKLIST_CRITICAL
02 Page content
- The page shows few of the signs expected from a trustworthy operator.Page content
rule:PAGE_TRUST_QUALITY_LOW - The review of the page content rated it moderate risk.Page content
rule:PAGE_RISK_MED - The page appears to present itself as a known brand it is not verified to belong to.Page content
rule:PAGE_BRAND_SUSPECTED - The browser raised a warning while loading the page.Page content
rule:PAGE_BROWSER_FLAGS_SUSPICIOUS
03 Behaviour in a sandbox
- Most of what the page loaded came from other domains rather than from this one.Behaviour in a sandbox
rule:BEHAV_EXTERNAL_RATIO_HIGH
Identity verification
| Status | UNVERIFIED |
|---|---|
| Identity score | 30/100 |
| Identity verification confidence | 50% |
- No on-site identity signals detected
Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence.
What TrustSniffer observed
First-party facts recorded during the assessment of votes-virtualagent-21.pages.dev.
- The request stayed on votes-virtualagent-21.pages.dev. It was not redirected to another domain. Clear
- It is hosted on CLOUDFLARENET, from a server in US. Noted
Domain intelligence
| Registrar | Not available |
|---|---|
| Hosting | CLOUDFLARENET - Cloudflare, Inc., US |
| Country | US |
| Server IP | 2606:4700:310c::ac42:2c8b |
| Name servers | Not available |
| CDN / edge network | Detected (cloudflare) |
| Resolved IP addresses | 4 |
| Edge IP addresses | 4 |
| Likely origin IP addresses | 0 |
| SSL issuer | YE2 |
| SSL expiry | 2027-01-04 |
| Domain age | Not available (no registration date was returned) |
| Domain expiry | Not available |
| Archive first seen | Not available |
| Archive snapshots | Not counted (archive lookup incomplete) |
| Reputation | VirusTotal: 3 flagged | AbuseIPDB: 0% confidence, 0 reports | Google Safe Browsing: 1 match |
About this assessment
A trust score summarises the evidence TrustSniffer could collect about votes-virtualagent-21.pages.dev at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.
TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.