---
title: "Is crypto-pfw.netlify.app a Scam? Trust Score 0/100"
source: TrustSniffer
type: Website trust & fraud report
subject: "crypto-pfw.netlify.app"
verdict: "Critical Risk"
title: "Is crypto-pfw.netlify.app a Scam? Risk Report, Score 0/100"
trust_score: 0
classification_confidence: 75
canonical_url: https://trustsniffer.com/report/crypto-pfw.netlify.app
assessed: 2026-10-20
---

# Is crypto-pfw.netlify.app a scam? TrustSniffer's high-risk assessment: 0/100

## Verdict


**Verdict: Critical Risk, trust score 0/100.** crypto-pfw.netlify.app shows high-risk / scam indicators.

This assessment found strong scam indicators. Do not pay, sign in, or share personal details with this site.

Labels: Sensitive Interaction Risk, Governance Risk

Assessed 2026-10-20 by automated analysis. Classification confidence 75%.

| Field | Value |
| --- | --- |
| What this site appears to be | The page is the default Netlify 404 error screen reporting that the requested site or path does not exist. It contains no service description, business content, forms, or links. |

## Evidence status and limitations


Evidence completeness: Not recorded

- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.

## At a glance

The checks that decide most of this verdict.

| Check | Result | Status |
| --- | --- | --- |
| Malware engines | 1 flagged it (VirusTotal) | Risk |
| Google Safe Browsing | Not listed (Google) | Clear |
| Abuse reports on the host | 1% confidence (AbuseIPDB, 4 reports; shared hosting inflates reports) | Clear |
| Domain age | 11 days old (Most scam domains are under a year old) | Risk |
| Web archive | Archived since 2026 (1 snapshot) | Clear |
| Certificate | Encrypted connection (Issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1) | Noted |

## The page as captured


![Screenshot of the crypto-pfw.netlify.app homepage captured during the TrustSniffer assessment](https://trustsniffer.com/outputs/crypto-pfw.netlify.app/screenshots/first.png)

_What crypto-pfw.netlify.app served when TrustSniffer captured it on 2026-10-20. The page may look different now._

## Key findings


- Automated classification: Sensitive Interaction Risk.
- Domain age: less than 1 year (registration continuity).
- Public web-archive history exists since 2026.
- At least one reputation service TrustSniffer consulted had flagged this domain at assessment time.

## Full analysis


### Overview

This website is a Netlify-hosted subdomain with a crypto-themed name. At the time of capture it showed only the hosting platform's default "Site not found" error screen. The page says the requested site or path does not exist, shows a platform support reference and a generic "Start building" prompt for the hosting service, and has no products, services, navigation, or links. It has no visible business model or operator, so its apparent purpose is an unclaimed, removed, or placeholder deployment.


### Scam/Impersonation Risk

One hard contradiction is present: an external reputation source currently lists this address as **blacklisted**. Separate detection engines returned both a malicious and a suspicious verdict. Separately, abuse reports exist against one of the shared edge addresses that serves the site. These reports relate to shared provider infrastructure, so on their own they say little about the site's operator. They are not discounted, however, and they add to the unfavourable reputation picture. No conflicting legal identities and no confirmed brand impersonation were observed. The domain name does resemble the hosting platform's own domain, but the page content is the platform's genuine default notice and makes no attempt to pass itself off as the platform. The more serious concern is behavioural. Although the visible page contains no forms, the sandbox detected hidden forms, including password-type fields, in every run. It also recorded a very large volume of page changes after interaction and a heavy share of outbound network activity. Outbound requests went to known destinations, but this behaviour does not fit a static error page. Credential-capture potential cannot be excluded and warrants a clearly cautionary stance.


Evidence:
- Domain and archive provenance: first archive observation 2026-10-08, one snapshot in total, about 11 days old, so no established history exists.
- External reputation: one malicious and one suspicious detection from separate engines, plus 4 abuse reports on a shared edge IP (the site's IPv6 edge address, 2a05:d014:58f:6200::258, hosted by Amazon Data Services Ireland).
- Sandbox: hidden forms in 3 of 3 runs, 3 password forms, 4,130 page mutations after interaction, and 21 outbound POST requests alongside 15 outbound XHR calls.
- Homepage: the visible page contains no forms, links, or metadata, which contrasts with the hidden-form activity.

### Regulatory Verification Notes

The site carries no legal or identity pages, so there is no company name, registration number, licence claim, terms, or privacy statement to assess. Because the page is only a platform error screen, this absence reflects an empty deployment rather than a deliberate omission. It does mean no operator can be tied to the site, and the real-world operator identity remains unverified. The TLS certificate is issued to the hosting platform's corporate entity, not to the site's operator. It therefore confirms encrypted transport but gives no assurance about who controls the content. No third-party broker or regulatory record was matched, and none should be inferred.


Evidence:
- Transport encryption: OV-validated certificate issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 to Netlify, Inc, valid to 2027-03-19.
- Hosting: served from AS16509 (AMAZON-02, Amazon.com, Inc., US).
- Homepage: no licence, authority, or registration number is claimed or displayed.

### What to Verify Next

The first step is to establish who controls this deployment and why the link exists. That means going back to whoever supplied the address and confirming through an independent, offline route that it is intended. If the address was presented as a crypto or financial service, the claimed operator's licence or registration must be confirmed directly with the relevant regulator's registry, not through anything on this site. Official support and contact channels should be obtained from the organisation's own known materials. The address should be re-assessed only after the reputation listing has cleared and a real, identifiable operator has published content.


Evidence:
- Homepage: no contact details, social profiles, or outbound links exist to cross-check.
- Identity: no independent signal connects the site to a real brand or person.
- Reputation: the external listing is current at the time of assessment, so any later change in status needs fresh confirmation.

### Summary Verdict

The site carries an elevated, high-risk posture. The external threat listing and the unexplained hidden-form behaviour sit on a very new, unestablished presence with no verifiable operator. These signals converge, and nothing in the evidence offsets them. Legitimacy cannot be inferred, and the platform's neutral error page does not change that.


### Infrastructure Integrity

The site sits behind an AWS-managed CDN/WAF. All four observed addresses are edge servers, and the origin server was not observable. The protective layer is a mitigating factor only and cannot offset the reputation risk. Edge-only visibility also prevents independent verification of the underlying hosting and can mask rapid content swaps behind the same address.


### Closing Assessment

Use should be limited to read-only viewing. No credentials, wallet connections, personal data, or payments should be submitted. Links from messages or advertisements that lead to this address should be treated as untrusted until a verified operator and a clean reputation are established.


_Written analysis generated 2026-10-20 by the TrustSniffer Analysis Engine from the evidence in this report._

## What the analysis found

5 findings contributed to this verdict, raised by external reputation, behaviour in a sandbox, hosting and network, history in the web archive, page content.

### 01 External reputation
- A small number of malware engines flagged this domain. On its own this is a weak signal. (External reputation `rule:EXT_BLACKLIST_MEDIUM`)

### 02 Behaviour in a sandbox
- The page contained a form a visitor cannot see. (Behaviour in a sandbox `rule:BEHAV_HIDDEN_FORMS`)

### 03 Hosting and network
- The domain was registered less than three months ago. (Hosting and network `rule:DNS_NEW_DOMAIN_90D`)

### 04 History in the web archive
- The web archive has almost no record of this domain, which fits a site that is new. (History in the web archive `rule:ARCH_PEN_YOUNG_AND_SPARSE`)

### 05 Page content
- The page appears to present itself as a known brand it is not verified to belong to. (Page content `rule:PAGE_BRAND_SUSPECTED`)

### Signals weighed against the site

- AbuseIPDB: 4 reports on hosting IP 2a05:d014:58f:6200::258 (Amazon Data Services Ireland Ltd, Content Delivery Network), 1% confidence. The reports are attributed to shared infrastructure, not specifically to this website.

## Identity verification


| Field | Value |
| --- | --- |
| Status | UNVERIFIED |
| Identity score | 30/100 |
| Identity verification confidence | 50% |

- No on-site identity signals detected

_Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence._

## What TrustSniffer observed

First-party facts recorded during the assessment of crypto-pfw.netlify.app.

- The request stayed on crypto-pfw.netlify.app. It was not redirected to another domain. (Clear)
- The earliest public archive of this site is from 2026-10-08. (Clear)
- It is hosted on AMAZON-02, from a server in US. (Noted)

## Domain intelligence


| Field | Value |
| --- | --- |
| Registrar | Not available |
| Hosting | AMAZON-02 - Amazon.com, Inc., US |
| Country | US |
| Server IP | 2a05:d014:58f:6200::258 |
| Name servers | Not available |
| CDN / edge network | Detected (aws) |
| Resolved IP addresses | 4 |
| Edge IP addresses | 4 |
| Likely origin IP addresses | 0 |
| SSL issuer | DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
| SSL expiry | 2027-03-19 |
| Domain age | 0.03 years (continuous registration) |
| Domain expiry | Not available |
| Archive first seen | 2026-10-08 |
| Archive snapshots | 1 |
| Reputation | VirusTotal: 1 flagged \| AbuseIPDB: 1% confidence, 4 reports \| Google Safe Browsing: 0 matches |

## About this assessment


**Was this report useful?** Tell other people what you think of TrustSniffer, good or bad. An honest review helps others decide whether to rely on these checks. [Review TrustSniffer on Trustpilot](https://www.trustpilot.com/review/trustsniffer.com)

A trust score summarises the evidence TrustSniffer could collect about crypto-pfw.netlify.app at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.

TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.

## Related on TrustSniffer
- [crypto-7lc.netlify.app](https://trustsniffer.com/report/crypto-7lc.netlify.app), a similar name (Critical Risk, 0/100)
- [crypto-pod.netlify.app](https://trustsniffer.com/report/crypto-pod.netlify.app), a similar name (Critical Risk, 0/100)
- [crypto-9ah.netlify.app](https://trustsniffer.com/report/crypto-9ah.netlify.app), a similar name (Critical Risk, 1/100)
- [crypto-bes.netlify.app](https://trustsniffer.com/report/crypto-bes.netlify.app), a similar name (Critical Risk, 0/100)
- [crypto-ls3.netlify.app](https://trustsniffer.com/report/crypto-ls3.netlify.app), a similar name (Critical Risk, 0/100)
- [okxrobinhood-claimtoken.netlify.app](https://trustsniffer.com/report/okxrobinhood-claimtoken.netlify.app), a similar name (Critical Risk, 0/100)
- [reward-claim-drop.netlify.app](https://trustsniffer.com/report/reward-claim-drop.netlify.app), a similar name (Critical Risk, 0/100)
- [defijup.netlify.app](https://trustsniffer.com/report/defijup.netlify.app), a similar name (Critical Risk, 0/100)
- [jimothy-solana.xyz](https://trustsniffer.com/report/jimothy-solana.xyz), another site assessed as critical-risk (Critical Risk, 0/100)
- [sinport.org](https://trustsniffer.com/report/sinport.org), another site assessed as critical-risk (Critical Risk, 0/100)
- [Every website and wallet TrustSniffer has assessed](https://trustsniffer.com/directory), the full risk directory
- [Other domains assessed as high-risk or phishing](https://trustsniffer.com/directory/phishing-domains), same verdict band
- [Check another website](https://trustsniffer.com/web-intelligence), run a new assessment
- [Check a crypto wallet address](https://trustsniffer.com/on-chain-risk), on-chain screening
- [The TrustSniffer Risk Index](https://trustsniffer.com/stats), how this verdict compares

## Guides
- [Stablecoin Freezes, Oct 24, 2026: 15 Wallets](https://trustsniffer.com/blog/stablecoin-freeze-report-2026-10-24)
- [Fake Airdrop Sites Show a Number, Not a Transfer](https://trustsniffer.com/blog/fake-airdrop-sites-show-a-number-not-a-transfer)
- [Crypto Scam Websites in 2026: What a List Misses](https://trustsniffer.com/blog/crypto-scam-websites-2026-what-a-list-misses)

---
*Source: [TrustSniffer](https://trustsniffer.com/report/crypto-pfw.netlify.app) — independent automated trust & fraud analysis. Cite as https://trustsniffer.com/report/crypto-pfw.netlify.app · assessed 2026-10-20.*