Is crypto-cpx.netlify.app a scam? TrustSniffer's high-risk assessment: 0/100

Overview

This website is a hosting-platform placeholder, not an operating service. Its address sits on a free subdomain of a public static-site hosting service, and the homepage returns a "Site not found" error page. The page says the visitor followed a broken link or entered a URL that does not exist on the platform. It carries no products, services, claims, contact details or visible forms, and no monetization or business model is apparent. The subdomain name suggests a crypto-themed project, but the page presents no crypto content. Nothing on it indicates what, if anything, the operator intends to publish at this address.

Scam/Impersonation Risk

The assessment is cautionary because contradictory signals are present. An external reputation check currently lists the address on a blacklist: one detection engine rated it malicious and another rated it suspicious. This is the decisive factor. Two abuse reports exist for an address in the hosting provider's shared network range. They are attributed to shared infrastructure and carry no reporting confidence, so they are discounted and not counted against the site. A page analyzer also flagged a possible resemblance to the hosting platform's own domain. This is a weak signal, because the site is simply a subdomain of that platform and no impersonation is confirmed. The most concerning behavioral finding is that the sandbox found hidden forms, including password-type fields, in all three runs on a page that visibly shows none. After interaction the page also underwent very heavy DOM mutation, which is unusual for a static error page. Together these indicate that the address can serve content very different from what its placeholder shows, and the content can change quickly. No wallet-connection, clipboard-hijack or drainer behavior was observed. No conflicting legal identities were found, because the site has no identity pages. Evidence:

• Homepage, external reputation check: blacklist hit, with 1 engine malicious and 1 suspicious.
• Homepage, sandbox behavior: hidden forms detected in 3 of 3 runs, with password fields present, and up to 4,130 DOM mutations after interaction.
• Domain provenance: the address is about 12 days old (first seen 2026-10-08), with 1 archive snapshot spanning one year tracked, so there is no history to establish continuity.
• Homepage, page analysis: possible lookalike of the hosting platform's domain, rated as a weak signal.

Regulatory Verification Notes

The site claims no license, registration or regulated status, and the placeholder page names no company, operator, address or governance structure. Because it offers no product or service, the absence of a license is not an accusation in itself. It does mean the real-world operator cannot be connected to any entity, and the ownership and governance opacity remains. No third-party broker or regulatory-database entry matched this site, so there is no external reputational context to weigh either way. The transport-encryption certificate is valid, but it belongs to the hosting platform and says nothing about whoever controls this subdomain. It supports the integrity of the connection, not the legitimacy of the operator. Evidence:

• Homepage: no company name, license number, jurisdiction or legal pages.
• Transport encryption: organization-validated certificate issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1, valid to 2027-03-19, with the subject organization being the hosting platform (Netlify, Inc).
• Hosting: served from AS16509 (AMAZON-02, US).

What to Verify Next

Do not treat this address as a legitimate counterparty until its operator is identified through an independent route. Anyone who received this address through a message, advertisement or social post should confirm with the sender, over a separate channel, that it is the intended destination. They should also check whether the sender's claimed project operates on a different, established domain. If the address is presented as a crypto or financial service, the claimed operator's licensing should be checked directly with the relevant financial regulator's registry, not on the basis of anything on this site. If the address belongs to the reader's own organization, the deployment and the hidden-form behavior should be investigated, because an empty placeholder should not contain password forms. Evidence:

• Homepage: returns a 404 status and shows only a platform support guide and a prompt to build a site, with no operator contact route.
• Homepage: no social profiles, outbound links or internal links to cross-check the operator.
• Sandbox behavior: the hidden password-type forms point to a possible repurposed or changing deployment that should be re-tested.

Summary Verdict

The overall posture is high-risk. The address is a newly observed placeholder with no demonstrable purpose, a confirmed external blacklist listing, and form and DOM behavior that does not match its visible content. The operator's identity is not independently verified, and nothing in the available evidence offsets the reputational and behavioral findings.

Infrastructure Integrity

The site is served through AWS network edge infrastructure that appears to be trusted, and all observed addresses are edge nodes. The origin server was not observable. That protection is a mitigating factor for transport reliability only. It cannot offset the external threat listing, and the edge-only visibility means content on this address could be swapped quickly without independent verification of what sits behind it.

Closing Assessment

Use is limited to read-only viewing, and only if necessary. Do not enter credentials, connect a wallet or make any payment on this address. Anyone directed here should disregard the link and use only an independently confirmed official address for the service they were seeking.

Signals weighed against the site

• AbuseIPDB: 2 reports on hosting IP 2a05:d014:58f:6200::259 (Amazon Data Services Ireland Ltd, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.