Is votingchoicemonitor.netlify.app safe? TrustSniffer's low-trust assessment: 46/100

Overview

This website is a subdomain published on a public application-hosting platform. Its name suggests a voting-related monitoring or tracking service. The analysis could not extract substantive product, pricing or operator content from the homepage, so its purpose and business model cannot be characterised beyond the name and the hosting arrangement. The site is young and shares its parent platform's domain space.

Scam/Impersonation Risk

Contradictory signals are present, and they drive a cautionary posture. Several independent reputation engines currently classify the site as malicious or suspicious, and the site also carries an external blacklist listing. These are the decisive findings, and the site's protective hosting and valid certificate cannot offset them. No brand impersonation, phishing page or conflicting legal identities were confirmed from page content, and no suspicious contact address was observed. The detections nonetheless point to a site that may be used to host harmful or deceptive content. A freshly created domain on a free hosting namespace is a pattern commonly seen in short-lived, disposable campaigns. Two abuse reports exist against an edge address in the hosting provider's shared network. These apply to shared provider infrastructure rather than to this site specifically, so they are discounted and not treated as evidence against it. In the behavioural sandbox, the homepage made no outbound data transfers, showed no hidden forms, wallet prompts or clipboard manipulation, and showed no cloaking. That is a mitigating observation about the captured page, but it does not outweigh the external detections. Evidence:

• Two reputation engines rated the site malicious and one rated it suspicious across the homepage scan, alongside an additional external blacklist listing.
• The domain is roughly 40 days old (about 0.11 years), registered in 2026, which is a very recent registration.
• 435 archive snapshots were recorded within a single year (2026), all from the current year, so there is no long history to offset the detections.
• The sandbox ran three homepage sessions, all returning stable HTTP 200 with zero external requests and zero console errors.

Regulatory Verification Notes

The captured homepage did not yield identifiable legal-entity, licensing or registration disclosures, and the real-world operator could not be independently connected to any known organisation or individual. This is a verification limitation and does not by itself indicate fraud. Here it sits alongside the external threat detections, which is why it cannot be treated as benign. No third-party broker or regulatory-database entry matched the site, so there is no external reputational or licensing context in either direction. The site's TLS certificate is organisation-validated, but the named subject is the hosting platform and not the site's operator. The certificate therefore confirms secure transport and does not identify who runs the site. Evidence:

• The homepage shows no company name, licence or registration number in the content captured.
• The site is served from AS16509 (AMAZON-02, Amazon.com, Inc., US).
• The TLS certificate was issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 at OV level, with subject organisation Netlify, Inc and validity to 2027-03-19.
• No matching broker-reputation record was found.

What to Verify Next

Before any engagement, the operator's identity should be established through channels independent of the site, and sensitive use should be deferred until the external detections are cleared. The exact entity behind the service, and any claimed licence or registration, should be confirmed with the relevant registry. Anyone who received a link to this address by message, email or social media should confirm the sender's authenticity through an offline route. Official support or contact channels should be obtained from a trusted external source and not from the site. The security team should also check whether the detections are being re-evaluated or have been resolved by the hosting platform. Evidence:

• The homepage presents no verifiable operator identity to check against a registry.
• The subdomain-based address provides no independent brand anchor to confirm authenticity.
• The detections come from multiple independent sources, so remediation or removal can be tracked externally.

Summary Verdict

The site carries an elevated risk posture. External threat detections are the decisive factor, and they outweigh the clean behavioural sandbox results and the valid encryption. Legitimacy cannot be inferred from the available evidence, and the operator's identity remains unestablished. The site should be treated as unsafe for any sensitive interaction.

Infrastructure Integrity

The site is delivered through Amazon Web Services edge infrastructure, with every observed address belonging to CDN edge servers. The origin server was not observable. This provides stable, well-maintained delivery and transport encryption, and it is a mitigating factor only. Edge-only visibility also prevents independent verification of where the content originates and can mask rapid content changes. Protective infrastructure is not evidence of legitimacy.

Closing Assessment

Treat the site as high-risk. Do not enter credentials, sign in, connect a wallet or make any payment or financial submission on it. Open the site only for read-only observation, and only from an isolated, non-sensitive environment. If it reached the reader through an unsolicited message, report that message and discard it.

Signals weighed against the site

• AbuseIPDB: 2 reports on hosting IP 2a05:d014:58f:6200::259 (Amazon Data Services Ireland Ltd, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.