Is crypto-pwy.netlify.app safe? TrustSniffer's low-trust assessment: 25/100

Overview

This is a subdomain on a free application-hosting platform whose homepage currently returns only the platform's generic "Site not found" error page. It shows no product, pricing, legal identity, or offers, and no stated purpose or business model is observable. The subdomain name alludes to cryptocurrency, but nothing on the page substantiates that theme.

Scam/Impersonation Risk

The assessment is cautionary because the address is blacklisted by external threat-detection sources: one engine rates it malicious and another rates it suspicious. A blacklisting on a site with no visible content is a significant concern. The homepage cannot explain it, and the listing may point to content that is served elsewhere, served selectively, or has since been removed. Behavioral testing adds to the concern. In every test run, the page loaded hidden forms, including password-type fields, even though the visible page contains none. The page structure also changed heavily after interaction. This is incompatible with a static error placeholder and suggests that undisclosed credential-capture or dynamic content could be present. The page analysis flags a strong lookalike relationship with the hosting platform's own brand. That flag is a similarity indicator, not a confirmed impersonation. No conflicting legal identities were found, and no phishing page was directly observed. Two abuse reports exist for an Amazon-operated address shared by many tenants. They are discounted because they cannot be attributed to this site. The site also sits on a very young subdomain that the browser-based tests judged to be unstable, so the external listing is not offset by any history of benign operation. Evidence:

• Homepage: returns the platform's "Site not found" 404 page. It has no forms, links, offers, or legal content in the visible view.
• Behavioral sandbox: hidden forms with password fields were detected in 3 of 3 runs, and the page structure changed by 4,130 DOM mutations after interaction.
• Domain provenance: the subdomain is about 11 days old (0.03 years), with a single archive snapshot dated 2026-10-08.
• Reputation: external detections include 1 malicious and 1 suspicious verdict. The 2 abuse reports apply to a shared Amazon address (2a05:d014:58f:6200::259) and are discounted.

Regulatory Verification Notes

The site presents no legal, about, terms, or licensing pages. The only page retrieved is the hosting error placeholder, so no operator, company, registration, or license is stated. No third-party broker or regulatory profile matched the site. This is a verification gap and not evidence of wrongdoing in itself. The owner of the subdomain is not identified, and this ownership opacity prevents any independent link to a real-world brand or person. If the name is later used to offer crypto, trading, or financial services, any such activity would need to be backed by a verifiable licensed entity. No such entity can be connected to the site at present. The encryption certificate is valid and organization-validated, but it names the hosting platform's operator and not the site's owner, so it does not establish who runs this site. Evidence:

• Homepage and site content: no operator name, company registration, license number, or contact details are published.
• Third-party broker data: no matching entry, so there is no regulatory or reputational profile to rely on.
• Transport security: TLS certificate issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 (OV) to Netlify, Inc, valid to 2027-03-19.
• Hosting: served from AS16509 (AMAZON-02, Amazon.com, Inc., US).

What to Verify Next

The first step is to determine who controls the subdomain and why the hidden forms are present. The platform's abuse channel could confirm whether the deployment is active, suspended, or flagged. The external listing should be reviewed with the listing sources directly, to see which URL or file triggered the detection and whether it has been cleared. If the site is later redeployed with content, any claim of a crypto service should be checked against the relevant financial regulator's registry. Contact channels should be confirmed through an independent route and not through links on the site. Until these checks are completed, the site should not be treated as a legitimate service endpoint. Evidence:

• Homepage: the deployment currently returns a not-found response, which suggests the content was removed, never published, or is served selectively.
• External listing: the detections attach to this exact subdomain and not to the shared platform domain.
• Behavioral sandbox: the unexplained hidden password forms are the key item for the owner or platform to explain.

Summary Verdict

The overall posture is high-risk. Confirmed external blacklisting, unexplained hidden credential fields, a very new subdomain, and an unidentifiable operator together outweigh the technically sound transport security. No concrete evidence of legitimate commercial activity exists to counterbalance them. The site is not suitable for any sensitive interaction.

Infrastructure Integrity

The subdomain is served from Amazon-operated infrastructure behind a CDN/WAF layer. All four observed addresses are edge addresses, and the origin server was not observable. This is a mitigating factor only. It indicates mainstream hosting with a valid certificate, but it cannot offset the external threat detections, and it limits independent verification of what is actually hosted. Edge-only visibility can also conceal rapid content swaps behind the same address.

Closing Assessment

At most, the site may be viewed passively. Logging in, entering credentials, connecting wallets, or making any payment or financial transfer should be avoided entirely until the external listing is cleared and an accountable operator is verifiably identified.

Signals weighed against the site

• AbuseIPDB: 2 reports on hosting IP 2a05:d014:58f:6200::259 (Amazon Data Services Ireland Ltd, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.