Verdict
This assessment found strong scam indicators. Do not pay, sign in, or share personal details with this site.
crypto-pfw.netlify.app shows high-risk / scam indicators.
| What this site appears to be | The page is the default Netlify 404 error screen reporting that the requested site or path does not exist. It contains no service description, business content, forms, or links. |
|---|
Evidence status and limitations
Evidence completeness: Not recorded
- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.
At a glance
The checks that decide most of this verdict.
| Malware engines | 1 flagged itVirusTotal | Risk |
|---|---|---|
| Google Safe Browsing | Not listedGoogle | Clear |
| Abuse reports on the host | 1% confidenceAbuseIPDB, 4 reports; shared hosting inflates reports | Clear |
| Domain age | 11 days oldMost scam domains are under a year old | Risk |
| Web archive | Archived since 20261 snapshot | Clear |
| Certificate | Encrypted connectionIssued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 | Noted |
The page as captured
Key findings
- Automated classification: Sensitive Interaction Risk.
- Domain age: less than 1 year (registration continuity).
- Public web-archive history exists since 2026.
- At least one reputation service TrustSniffer consulted had flagged this domain at assessment time.
Full analysis
Overview
This website is a Netlify-hosted subdomain with a crypto-themed name. At the time of capture it showed only the hosting platform's default "Site not found" error screen. The page says the requested site or path does not exist, shows a platform support reference and a generic "Start building" prompt for the hosting service, and has no products, services, navigation, or links. It has no visible business model or operator, so its apparent purpose is an unclaimed, removed, or placeholder deployment.
Scam/Impersonation Risk
One hard contradiction is present: an external reputation source currently lists this address as blacklisted. Separate detection engines returned both a malicious and a suspicious verdict. Separately, abuse reports exist against one of the shared edge addresses that serves the site. These reports relate to shared provider infrastructure, so on their own they say little about the site's operator. They are not discounted, however, and they add to the unfavourable reputation picture. No conflicting legal identities and no confirmed brand impersonation were observed. The domain name does resemble the hosting platform's own domain, but the page content is the platform's genuine default notice and makes no attempt to pass itself off as the platform. The more serious concern is behavioural. Although the visible page contains no forms, the sandbox detected hidden forms, including password-type fields, in every run. It also recorded a very large volume of page changes after interaction and a heavy share of outbound network activity. Outbound requests went to known destinations, but this behaviour does not fit a static error page. Credential-capture potential cannot be excluded and warrants a clearly cautionary stance.
- Domain and archive provenance: first archive observation 2026-10-08, one snapshot in total, about 11 days old, so no established history exists.
- External reputation: one malicious and one suspicious detection from separate engines, plus 4 abuse reports on a shared edge IP (the site's IPv6 edge address, 2a05:d014:58f:6200::258, hosted by Amazon Data Services Ireland).
- Sandbox: hidden forms in 3 of 3 runs, 3 password forms, 4,130 page mutations after interaction, and 21 outbound POST requests alongside 15 outbound XHR calls.
- Homepage: the visible page contains no forms, links, or metadata, which contrasts with the hidden-form activity.
Regulatory Verification Notes
The site carries no legal or identity pages, so there is no company name, registration number, licence claim, terms, or privacy statement to assess. Because the page is only a platform error screen, this absence reflects an empty deployment rather than a deliberate omission. It does mean no operator can be tied to the site, and the real-world operator identity remains unverified. The TLS certificate is issued to the hosting platform's corporate entity, not to the site's operator. It therefore confirms encrypted transport but gives no assurance about who controls the content. No third-party broker or regulatory record was matched, and none should be inferred.
- Transport encryption: OV-validated certificate issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 to Netlify, Inc, valid to 2027-03-19.
- Hosting: served from AS16509 (AMAZON-02, Amazon.com, Inc., US).
- Homepage: no licence, authority, or registration number is claimed or displayed.
What to Verify Next
The first step is to establish who controls this deployment and why the link exists. That means going back to whoever supplied the address and confirming through an independent, offline route that it is intended. If the address was presented as a crypto or financial service, the claimed operator's licence or registration must be confirmed directly with the relevant regulator's registry, not through anything on this site. Official support and contact channels should be obtained from the organisation's own known materials. The address should be re-assessed only after the reputation listing has cleared and a real, identifiable operator has published content.
- Homepage: no contact details, social profiles, or outbound links exist to cross-check.
- Identity: no independent signal connects the site to a real brand or person.
- Reputation: the external listing is current at the time of assessment, so any later change in status needs fresh confirmation.
Summary Verdict
The site carries an elevated, high-risk posture. The external threat listing and the unexplained hidden-form behaviour sit on a very new, unestablished presence with no verifiable operator. These signals converge, and nothing in the evidence offsets them. Legitimacy cannot be inferred, and the platform's neutral error page does not change that.
Infrastructure Integrity
The site sits behind an AWS-managed CDN/WAF. All four observed addresses are edge servers, and the origin server was not observable. The protective layer is a mitigating factor only and cannot offset the reputation risk. Edge-only visibility also prevents independent verification of the underlying hosting and can mask rapid content swaps behind the same address.
Closing Assessment
Use should be limited to read-only viewing. No credentials, wallet connections, personal data, or payments should be submitted. Links from messages or advertisements that lead to this address should be treated as untrusted until a verified operator and a clean reputation are established.
Written analysis generated 2026-10-20 by the TrustSniffer Analysis Engine from the evidence in this report.
What the analysis found
5 findings contributed to this verdict, raised by external reputation, behaviour in a sandbox, hosting and network, history in the web archive, page content.
01 External reputation
- A small number of malware engines flagged this domain. On its own this is a weak signal.External reputation
rule:EXT_BLACKLIST_MEDIUM
02 Behaviour in a sandbox
- The page contained a form a visitor cannot see.Behaviour in a sandbox
rule:BEHAV_HIDDEN_FORMS
03 Hosting and network
- The domain was registered less than three months ago.Hosting and network
rule:DNS_NEW_DOMAIN_90D
04 History in the web archive
- The web archive has almost no record of this domain, which fits a site that is new.History in the web archive
rule:ARCH_PEN_YOUNG_AND_SPARSE
05 Page content
- The page appears to present itself as a known brand it is not verified to belong to.Page content
rule:PAGE_BRAND_SUSPECTED
Signals weighed against the site
- AbuseIPDB: 4 reports on hosting IP 2a05:d014:58f:6200::258 (Amazon Data Services Ireland Ltd, Content Delivery Network), 1% confidence. The reports are attributed to shared infrastructure, not specifically to this website.
Identity verification
| Status | UNVERIFIED |
|---|---|
| Identity score | 30/100 |
| Identity verification confidence | 50% |
- No on-site identity signals detected
Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence.
What TrustSniffer observed
First-party facts recorded during the assessment of crypto-pfw.netlify.app.
- The request stayed on crypto-pfw.netlify.app. It was not redirected to another domain. Clear
- The earliest public archive of this site is from 2026-10-08. Clear
- It is hosted on AMAZON-02, from a server in US. Noted
Domain intelligence
| Registrar | Not available |
|---|---|
| Hosting | AMAZON-02 - Amazon.com, Inc., US |
| Country | US |
| Server IP | 2a05:d014:58f:6200::258 |
| Name servers | Not available |
| CDN / edge network | Detected (aws) |
| Resolved IP addresses | 4 |
| Edge IP addresses | 4 |
| Likely origin IP addresses | 0 |
| SSL issuer | DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
| SSL expiry | 2027-03-19 |
| Domain age | 0.03 years (continuous registration) |
| Domain expiry | Not available |
| Archive first seen | 2026-10-08 |
| Archive snapshots | 1 |
| Reputation | VirusTotal: 1 flagged | AbuseIPDB: 1% confidence, 4 reports | Google Safe Browsing: 0 matches |
About this assessment
A trust score summarises the evidence TrustSniffer could collect about crypto-pfw.netlify.app at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.
TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.