Verdict
This assessment found strong scam indicators. Do not pay, sign in, or share personal details with this site.
crypto-fq2.netlify.app shows high-risk / scam indicators.
Evidence status and limitations
Evidence completeness: Not recorded
- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.
At a glance
The checks that decide most of this verdict.
| Malware engines | 1 flagged itVirusTotal | Risk |
|---|---|---|
| Google Safe Browsing | Not listedGoogle | Clear |
| Abuse reports on the host | 0% confidenceAbuseIPDB, 2 reports; shared hosting inflates reports | Clear |
| Domain age | 18 days oldMost scam domains are under a year old | Risk |
| Web archive | Archived since 20261 snapshot | Clear |
| Certificate | Encrypted connectionIssued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 | Noted |
The page as captured
Key findings
- Automated classification: Sensitive Interaction Risk.
- Domain age: less than 1 year (registration continuity).
- Public web-archive history exists since 2026.
- At least one reputation service TrustSniffer consulted had flagged this domain at assessment time.
Full analysis
Overview
This website is a subdomain on the Netlify hosting platform. Its name suggests a cryptocurrency theme, but the page captured at the root presented only a short "Site not found" error with minimal text. No products, brand, operator or business model were visible. The domain was created very recently. Its apparent purpose is therefore undetermined from content, and it appears to be a newly provisioned, unbranded deployment.
Scam/Impersonation Risk
This site carries a confirmed external blacklist listing. Third-party threat-intelligence sources flagged the domain: one engine rated it malicious and two rated it suspicious. This is the decisive contradiction and drives a clearly cautionary posture. No conflicting legal identities and no brand impersonation were observed, because the page exposes no identity content to compare. Behavioural testing found further anomalies. The error page contained several hidden forms, including password-type fields, which appeared consistently across repeated runs. The page also showed an unusually large volume of DOM changes after interaction, and nearly all of its network activity went to external hosts. A page presenting "site not found" while carrying concealed credential-capture-capable form elements is an inconsistent combination. It is consistent with a placeholder, a staging shell, or a credential-harvesting template awaiting content, and the evidence does not distinguish between these. Two abuse reports were recorded against a shared edge address at the hosting provider. They were discounted because they attach to shared infrastructure, not to this site specifically, and they do not add to the blacklist signal. The site's domain label closely tracks the hosting platform's domain, and its crypto-themed name offers no verifiable link to any real project or brand.
- Homepage: external reputation sources list the domain, with one malicious and two suspicious engine verdicts.
- Homepage: three hidden forms with password-type fields were detected consistently across all three behavioural runs, on a page that visibly shows only an error message.
- Homepage: about 4,130 DOM mutations after interaction, with roughly 99.6% of external network activity directed to third-party hosts.
- Domain provenance: the domain is about 20 days old (registered 2026). The web archive holds 1 snapshot, first and last seen in 2026 (1 year tracked), so there is no established history.
Regulatory Verification Notes
The captured page contains no legal, terms, privacy or about content. It names no operating company, registration number, licence or regulator, and it makes no regulated-activity claims. For a crypto-themed domain this absence is a disclosure gap. It is not by itself evidence of fraud, and the confirmed blacklist signal is what carries the risk assessment. The real-world operator is not independently connected to this domain, and ownership is opaque. No third-party broker or regulatory-database match exists for the site, so there is no reputational or licensing context to weigh in either direction. The transport-encryption certificate is organisation-validated, but it is issued to the hosting platform, not to any site operator. It therefore confirms secure transport only and says nothing about who runs the content.
- Homepage: no company name, licence, registration number or regulator is stated, and no legal pages exist.
- Hosting: served from AS16509 (AMAZON-02, Amazon.com, Inc., US).
- Transport encryption: TLS certificate issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 (OV), subject organisation Netlify, Inc, valid to 2027-03-19.
- Third-party reputation: no matching broker or regulatory-database record for the domain.
What to Verify Next
The first step is to establish whether the domain is officially linked to any claimed project or company. That means finding the operator's own publication of the address through an independent channel, such as the project's verified social profiles or its established website, and not through any link supplied by the site or by the person who shared it. Any claim of licensing should be checked in the relevant national financial regulator's public register using the entity's legal name. Any contact or support channel should be confirmed through that independent route before it is used. The site's blacklist status should be re-checked after a reasonable interval. A clean re-check would show the listing was a transient or false positive, while persistence would confirm the concern. Until a legitimate owner is established, no form on the site should be treated as genuine.
- Homepage: the captured page offers no stated operator, so independent attribution is the only route to identity.
- Domain provenance: the domain is only weeks old (about 20 days), with a single archive capture, so no long-term operating record exists to rely on.
- Homepage: the hidden password-type forms mean any credential entry on the site cannot be assumed to reach a legitimate service.
Summary Verdict
The overall posture is high-risk. A confirmed external blacklist listing, together with concealed credential-type forms and a very recent, unattributed deployment, outweighs the site's technically sound transport encryption and mainstream hosting. Its apparent legitimacy is not supported by the evidence, and its real-world operator is unverified.
Infrastructure Integrity
The site is served through Amazon's content-delivery edge network, and every observed address is an edge node. The origin server was not observable. This arrangement is a mitigating factor for availability and basic transport security, but it cannot offset the reputation findings. Edge-only visibility also prevents independent verification of the true hosting origin and can mask rapid content swaps on a newly created site. Its protective value should not be read as evidence of legitimacy.
Closing Assessment
The site should be limited to passive, read-only viewing at most. No login, credentials, wallet connection or financial transaction should be attempted unless an independent source establishes who operates it and the blacklist concern is cleared.
Written analysis generated 2026-10-22 by the TrustSniffer Analysis Engine from the evidence in this report.
What the analysis found
4 findings contributed to this verdict, raised by external reputation, behaviour in a sandbox, hosting and network, history in the web archive.
01 External reputation
- Several malware engines flagged this domain.External reputation
rule:EXT_BLACKLIST_HIGH
02 Behaviour in a sandbox
- The page contained a form a visitor cannot see.Behaviour in a sandbox
rule:BEHAV_HIDDEN_FORMS - Most of what the page loaded came from other domains rather than from this one.Behaviour in a sandbox
rule:BEHAV_EXTERNAL_RATIO_HIGH
03 Hosting and network
- The domain was registered less than three months ago.Hosting and network
rule:DNS_NEW_DOMAIN_90D
04 History in the web archive
- The web archive has almost no record of this domain, which fits a site that is new.History in the web archive
rule:ARCH_PEN_YOUNG_AND_SPARSE
Signals weighed against the site
- AbuseIPDB: 2 reports on hosting IP 2a05:d014:58f:6200::259 (Amazon Data Services Ireland Ltd, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.
Identity verification
| Status | UNKNOWN |
|---|---|
| Identity score | 50/100 |
| Identity verification confidence | 30% |
- AI page analysis unavailable (page captured; identity not AI-verified)
Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence.
What TrustSniffer observed
First-party facts recorded during the assessment of crypto-fq2.netlify.app.
- The request stayed on crypto-fq2.netlify.app. It was not redirected to another domain. Clear
- The earliest public archive of this site is from 2026-10-01. Clear
- It is hosted on AMAZON-02, from a server in US. Noted
Domain intelligence
| Registrar | Not available |
|---|---|
| Hosting | AMAZON-02 - Amazon.com, Inc., US |
| Country | US |
| Server IP | 2a05:d014:58f:6200::259 |
| Name servers | Not available |
| CDN / edge network | Detected (aws) |
| Resolved IP addresses | 4 |
| Edge IP addresses | 4 |
| Likely origin IP addresses | 0 |
| SSL issuer | DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
| SSL expiry | 2027-03-19 |
| Domain age | 0.05 years (continuous registration) |
| Domain expiry | Not available |
| Archive first seen | 2026-10-01 |
| Archive snapshots | 1 |
| Reputation | VirusTotal: 1 flagged | AbuseIPDB: 0% confidence, 2 reports | Google Safe Browsing: 0 matches |
About this assessment
A trust score summarises the evidence TrustSniffer could collect about crypto-fq2.netlify.app at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.
TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.