Is crypto-ls3.netlify.app a scam? TrustSniffer's high-risk assessment: 0/100

Overview

This website is a subdomain on the Netlify hosting platform, named in a way that suggests a cryptocurrency-related project. At the time of analysis, its landing page was only the platform's standard "Site not found" error. The page says the requested address does not exist on Netlify and points to a troubleshooting guide and a "Start building" prompt. It shows no products, services, company name, or monetization model, so its apparent purpose cannot be determined from what it publishes. It looks like an unclaimed, abandoned, or not-yet-deployed hosting slot.

Scam/Impersonation Risk

Contradictory signals are present. The address is flagged by an external reputation source as blacklisted, with one security engine rating it malicious and another suspicious. The strength and breadth of that listing is moderate, but it is a confirmed adverse record. No contact email appears on the page, and no conflicting legal identities exist, because no identity content is published at all. Automated page analysis also found the address strongly resembles the hosting platform's own brand domain, which is consistent with a lookalike or an abused slot on that platform. The visible error page conflicts with what the sandbox observed. Hidden form elements, including password-type fields, appeared in every browser run even though the page shows no forms. Very large DOM changes followed simulated interaction, nearly all network traffic went to external destinations, and the final destination was flagged as mismatching. Together these point to content that is not visible on the surface and could be swapped in or activated later. Abuse reports against the shared hosting address are attributed to the provider's shared infrastructure, not to this site, and carry little weight on their own. The blacklist hit and the hidden-form behavior are the decisive adverse signals. Evidence:

• Homepage: external reputation sources return a blacklist listing, with 1 malicious and 1 suspicious engine verdict.
• Domain provenance: the address was first observed about 11 days before analysis (registration continuity ~0.03 years).
• Web archive: 1 snapshot in 2026 (1 year tracked), which gives no meaningful history.
• Homepage sandbox: hidden forms were detected in 3 of 3 runs, with password fields present, and 4,130 DOM mutations followed interaction.

Regulatory Verification Notes

The page publishes no legal entity name, terms, privacy policy, licensing claim, registration number, or contact route. It is an error response, so there is nothing on it to assess or authenticate. The operator's real-world identity is unverified, and no independent evidence connects the site to any brand or person. Ownership and governance opacity both apply, and the site's content does nothing to resolve them. The valid TLS certificate is organization-validated for the hosting platform, not for whoever controls this subdomain. It confirms an encrypted connection and nothing about the operator. No third-party broker or regulatory-database match was found, so no regulatory status can be inferred in either direction. Evidence:

• Homepage: the platform's 404 content contains no company name, license, address, or terms.
• Transport encryption: certificate issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 (OV) to Netlify, Inc., valid to 2027-03-19.
• Hosting: served from AS16509 (AMAZON-02, Amazon.com, Inc., US).
• No matching broker or regulator record was found for the site.

What to Verify Next

Before any engagement, the party offering this address should be asked to name the legal entity and project behind it. That identity should be checked through the official website of the project or brand being claimed, reached independently and not through this address. If the address was received through a message, advertisement, or social post, the sender's channel should be authenticated through a separate, offline route. Any claim of a licensed or regulated crypto service should be checked directly against the relevant national registry. No wallet connection, login, or payment should be attempted unless the address is later shown to host genuine, attributable content. Evidence:

• Homepage: the page was a hosting-error response (HTTP 404), with no operator identity to validate.
• The domain's lookalike similarity to the hosting platform's brand domain was assessed as strong.
• No official-channel cross-links, social profiles, or external links are published on the page.

Summary Verdict

The assessment is critical and high-risk. The adverse reputation signals and the gap between the visible page and the observed hidden behavior outweigh the site's technical hygiene. The site has no attributable operator and no verifiable purpose, and the available evidence does not support treating it as a legitimate service.

Infrastructure Integrity

The site is served from Amazon-operated infrastructure behind a content-delivery layer, and all observed addresses are edge nodes. The true origin server was not observable. This is a mitigating factor only, because it reflects the hosting platform's standard setup and not any property of the site's operator. Seeing only the edge also prevents independent verification of where the content is hosted. It can mask rapid content swaps, which is a concern given the hidden-form behavior noted earlier.

Closing Assessment

Only read-only viewing is appropriate. Logging in, entering credentials, connecting a wallet, and making any financial transaction should be avoided. Any link that led here should be treated as suspect and reported to the party that supplied it.

Signals weighed against the site

• AbuseIPDB: 4 reports on hosting IP 2a05:d014:58f:6200::258 (Amazon Data Services Ireland Ltd, Content Delivery Network), 1% confidence. The reports are attributed to shared infrastructure, not specifically to this website.