Is crypto-sxa.netlify.app a scam? TrustSniffer's high-risk assessment: 0/100

Overview

This website is a crypto-themed subdomain on Netlify's shared hosting platform. At the time of analysis its homepage returned only the platform's generic "Site not found" 404 error page. The page offers no products, services, forms, or contact details, and it makes no commercial offer. Its apparent purpose and business model therefore cannot be determined from what is deployed. It reads as a placeholder, an undeployed project, or a removed site on a third-party hosting service.

Scam/Impersonation Risk

Contradictory signals are present, and they call for a clearly cautionary stance. An external reputation check currently places the site on a blacklist, with one malicious and one suspicious detection from threat-intelligence engines. The label is also a close lookalike of the hosting platform's own brand, and this is a recognised brand-impersonation pattern. Content analysis did not confirm impersonation, because the visible page is the platform's standard error text. The site's behaviour in the sandbox goes against that benign appearance. All three sandbox runs detected concealed form elements, including password-type fields, on a page that visibly shows no forms. The page also changed heavily in the browser after interaction, and nearly all of its network traffic went to external destinations. Together these point to a page that displays an innocuous error while holding, or able to load, credential-capture components. A crypto-themed name pairs poorly with that pattern, since it is the setting where wallet or login harvesting would be staged. The operator behind the subdomain is unidentified and its real-world identity is unverified. Two abuse reports exist against an address on the hosting provider's shared infrastructure. They are discounted because they relate to the provider's shared address and not to this site specifically. They do not add to the concern and do not offset the blacklist. Evidence:

• Homepage: shows only a platform 404 "Site not found" message with no forms, offers, or contact channels, while sandbox observation detected hidden password-bearing form elements in every run.
• Domain provenance: registered roughly 18 days before analysis (about 0.05 years old), a very recent creation.
• Web archive: 2 snapshots in total, covering a single year (2026), so there is almost no independent history to counter the adverse reputation signals.
• Reputation: the external blacklist hit comes from one malicious and one suspicious engine detection, with no regulatory or broker-dataset match.

Regulatory Verification Notes

The site presents no legal, terms, privacy, or about pages, and it claims no licence, registration, or regulated status. Nothing in the evidence supports a regulated-entity classification, and no independent registry link exists to connect the site to a company or individual. The absence of disclosures is a verification gap and not evidence of wrongdoing in itself. Here it compounds the unresolved operator identity and the adverse reputation findings. The broker-reputation dataset returned no match for the site, which gives neither support nor condemnation. Evidence:

• Homepage: contains no company name, licence number, jurisdiction, or legal-entity reference.
• Hosting: served from AS16509 (Amazon, AMAZON-02), US, registered with ARIN.
• Transport security: a valid OV certificate issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 to Netlify, Inc, valid to 2027-03-19. The certificate belongs to the hosting platform and does not authenticate the subdomain's operator.

What to Verify Next

Any dealings should rest on independent confirmation and not on this page. The first step is to establish through an offline or directly sourced route (for example, a published channel from a known organisation) whether the claimed counterparty actually uses this subdomain. If any financial or crypto service is represented as operating here, its authorisation should be checked directly with the relevant financial regulator's public register. The official support and contact channels should also be confirmed independently of anything shown on this page. If the subdomain is expected to host a legitimate project, the project owner should be asked to confirm it, and its deployed content and any hidden forms should be reviewed after cleanup. Evidence:

• Homepage: no operator, product, or contact information is published that could be used for confirmation.
• Sandbox behaviour: concealed form elements were present in all runs, which supports a content review before any trust is extended.
• Reputation: an active blacklist hit on this domain means the claimed use should be confirmed with the party that supplied the link.

Summary Verdict

The site carries an elevated, high-risk trust posture. The adverse external reputation finding, the behaviours at odds with the page's inert appearance, and an unverified operator identity converge. Positive technical signals such as a valid certificate and an established hosting platform are generic to the platform and cannot offset this.

Infrastructure Integrity

The site runs on Amazon-operated infrastructure behind a CDN/WAF layer. All four observed addresses are edge nodes, and no origin server was observable, so the real hosting location cannot be independently confirmed. This protective layer is a mitigating factor only. It supports basic transport and availability hygiene but cannot offset the reputation risk, and edge-only visibility can mask rapid content changes behind the same hostname.

Closing Assessment

The site should be treated as unsafe for any login, credential entry, wallet connection, or payment. If it is visited at all, that should be passive viewing only, with no downloads and no data submitted. Anyone who arrived via a message or advertisement should treat that source as suspect and report it.

Signals weighed against the site

• AbuseIPDB: 2 reports on hosting IP 2a05:d014:58f:6200::259 (Amazon Data Services Ireland Ltd, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.