Is crypto-kqv.netlify.app a scam? TrustSniffer's high-risk assessment: 0/100

Overview

This website is a subdomain on a shared static-hosting platform, and its name suggests a cryptocurrency theme. The captured homepage shows only a generic "site not found" placeholder with a very small amount of text. It presents no products, branding or stated business model, so its apparent purpose cannot be established from visible content. Automated browsing nonetheless detected active form and script behaviour behind the placeholder.

Scam/Impersonation Risk

Multiple independent reputation sources flag this site, and the site appears on a confirmed blacklist from third-party threat intelligence. At least two security engines classify it as malicious and one more as suspicious. The archive record also carries a known-phishing indicator, so this is a hard contradiction and not a soft reputational concern. Behavioural testing supports this. Three-of-three sandbox runs found hidden forms and password-capable forms, although the visible page is only a placeholder. Interaction triggered very large DOM mutations, a pattern consistent with content being injected or swapped after load. Nearly all network traffic went to external destinations. None of the external destinations was unfamiliar, and no wallet-drainer, clipboard-hijack or cloaking behaviour was observed. Two abuse reports exist against a shared cloud-provider edge address. These are discounted as shared-infrastructure noise and are not attributed to this site. The domain's own detections, a placeholder front with concealed credential-capable forms, and a crypto-themed name on a very new domain are together consistent with a staging or lure page. This does not establish that any specific brand is being impersonated, and no conflicting legal identities were observed. Evidence:

• Homepage: returned a "Site not found" error page with only minimal text, yet hidden forms, including password forms, were detected in every sandbox run.
• Homepage behaviour: roughly 4,130 DOM mutations after interaction and up to 99.6% of network activity directed to external hosts.
• Domain provenance: registered in 2026 (~20 days old, ~0.05 years).
• Archive depth: 206 snapshots, all within 2026 (1 year tracked).

Regulatory Verification Notes

The captured homepage shows no operator name, legal entity, licence, registration number or terms page. Operator identity remains unverified, and ownership and governance are opaque. This is a transparency gap on the site and not a finding of fraud in itself. Here it compounds the confirmed threat detections instead of standing alone. No financial-services or broker reputation record matched, so there is no third-party regulatory context to rely on. Transport security shows an organisation-validated certificate issued to the hosting platform. This indicates only that the platform's shared certificate is valid. It does not identify whoever operates this particular subdomain. Evidence:

• Homepage: no company name, licence number or legal disclosure is visible.
• Hosting: served from AS16509 (AMAZON-02, Amazon.com, Inc., US).
• Transport encryption: TLS certificate issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 (OV) to Netlify, Inc, valid to 2027-03.
• Broker reputation lookup: no matching record.

What to Verify Next

Any claim that this site belongs to a real company or crypto service should be checked through channels independent of the site. A prospective user should locate the claimed operator's official website through a trusted source such as a regulator register or an established directory, and confirm that this subdomain is formally listed there. Anyone who received this address through an unsolicited message, advertisement or social post should confirm with the apparent sender, using a separately sourced contact route, that they actually sent it. Security teams may wish to re-test the page to see whether the concealed forms and script behaviour change over time, and to report the address to the hosting platform's abuse desk. Any claimed licensing should be checked directly with the relevant registry, using the registry's own search. Evidence:

• Homepage: no named operator or official affiliation to cross-reference.
• Hidden forms: credential-capable fields present in all runs, so the contents need independent inspection.
• Reputation sources: multiple detections currently active against this address.

Summary Verdict

The site carries an elevated risk posture. Confirmed third-party blacklist hits, concealed credential-capable forms behind an empty front page, and a very recent domain converge on a clearly cautionary assessment. The valid certificate and a long-running, legitimate hosting platform are only mitigating factors. They do not offset the threat detections, and the real-world operator remains unidentified.

Infrastructure Integrity

The site is served through Amazon Web Services edge infrastructure, which is a reputable and widely used platform. All four observed addresses are edge nodes, and the origin server is not observable. A trusted provider is a mitigating signal only. Shared hosting of this kind makes it easy to launch short-lived sites and to swap their content quickly, so it provides no assurance about this subdomain's operator or content.

Closing Assessment

Limit interaction to passive viewing. Do not enter credentials, connect wallets, make payments or submit personal data, and do not download anything from this address. Treat any link that leads here as hostile until independent confirmation says otherwise.

Signals weighed against the site

• AbuseIPDB: 2 reports on hosting IP 2a05:d014:58f:6200::259 (Amazon Data Services Ireland Ltd, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.