Is crypto-xft.netlify.app safe? TrustSniffer's low-trust assessment: 25/100

Overview

This website is a subdomain on a public static-hosting platform, with a name that suggests a cryptocurrency project. It does not present a product. Its homepage returns the hosting provider's generic "Site not found" error, which says the address does not correspond to a deployed site. The page has no products, pricing, contact details or operator identity, and no business model can be inferred. Its apparent purpose is unknown. It may be a placeholder, a removed deployment, or a staging address for a crypto-themed project.

Scam/Impersonation Risk

Active threat signals contradict the plain appearance of this page. Two threat-intelligence engines currently classify the address as malicious and one more flags it as suspicious. This is the one case in which the term blacklisted applies: the address has a confirmed external blacklist listing. The domain was created very recently, so no reputational history offsets these detections. The name closely resembles the hosting platform's own brand, a lookalike pattern often used to pass a page off as a platform-controlled or official property. No conflicting legal identities appear, because no identity content exists to conflict. Browser sandbox runs also behaved inconsistently with a blank error page. Hidden forms were present in all three runs, and password-type fields were detected even though no visible form or login is shown. After interaction the page's structure mutated heavily, with thousands of DOM changes. Nearly all observed network traffic went to external destinations, including external background requests and POST submissions. Those destinations were individually judged benign, but the pattern is out of character for a static 404 page. Four abuse reports exist against an address in the hosting provider's shared pool, so they attach to shared infrastructure and are weak evidence against this specific site. The sandbox findings and the threat listings are the decisive signals. A hidden credential-capture capability behind an inert-looking page is consistent with staged or cloaked phishing infrastructure, although no phishing or impersonation was confirmed. Evidence:

• The domain was first observed on 2026-10-06 and is about 13 days old, with a single archive snapshot in 1 year tracked.
• Hidden forms were detected in 3 of 3 sandbox runs, with 3 password-type fields, 15 external background requests, 21 external POST submissions and 4,130 DOM mutations after interaction.
• The homepage carries the title "Site not found" and no meta description. The hosting brand is mimicked by name only, since the content is the provider's stock error text.

Regulatory Verification Notes

The homepage contains no legal, licensing, company or ownership information. Nothing on the page claims a financial or crypto-services license, so there is nothing to validate and nothing disclosed. A crypto-themed name with no licensing statement is a disclosure gap, not evidence of wrongdoing. The gap matters because the active threat detections elsewhere in this report point to elevated risk. The site's identity is unverified and cannot be tied to any real-world person or organisation. No third-party broker or regulatory-database record matches this name, so there is no external reputational context either way. The TLS certificate is valid and organisation-validated, but its subject is the hosting platform, not an independent operator. It therefore confirms only encrypted transport and the platform's identity. Evidence:

• The TLS certificate was issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 (OV) to Netlify, Inc, valid to 2027-03-19.
• The site is served from AS16509 (AMAZON-02 - Amazon.com, Inc., US), in US/ARIN address space.
• The homepage has no about, terms, privacy or contact content, and no social profiles are linked.

What to Verify Next

Verification should start by establishing whether any real operator stands behind this address. Anyone who was directed to this link by a message, advertisement or social account should trace that referral back to its source. The hosting platform's abuse channel can be asked whether the deployment is active, suspended or reported, because only the platform can map the internal reference on the error page to an account. A crypto-themed project that claims an official presence should be checked against channels reached independently of this link, such as the official site of the named project. Any claimed license should be checked in the relevant regulator's public registry, and contact channels confirmed through an offline route. Evidence:

• The error page shows a platform-internal reference identifier that only the hosting provider can resolve to an account.
• The homepage has no outbound or internal links, so nothing on it can be followed to corroborate an identity.
• The homepage logged 3 console errors during sandbox runs.

Summary Verdict

The overall posture is elevated risk. Confirmed external threat detections, recent creation, an unverified operator and concealed form behaviour outweigh the technically sound transport security. Nothing on the site offers a legitimate use that could balance these signals. The identity-uncertainty finding is a secondary concern next to the active detections.

Infrastructure Integrity

The site sits behind the AWS edge network, and all four observed addresses belong to edge servers, so the origin server is not visible. This is typical of a hosted-platform deployment and mitigates exposure of the origin, but it also prevents independent confirmation of what is actually hosted. Content can be swapped quickly behind the edge. Protective infrastructure does not offset the reputational detections, and it is no evidence of legitimacy.

Closing Assessment

The address should be treated as unsafe for any interaction beyond passive viewing. Credentials, wallet details and payment information should not be entered, and nothing should be downloaded from it. Anyone who has already interacted with it should change reused passwords, review wallet approvals, and report the link to the referring platform and the hosting provider.

Signals weighed against the site

• AbuseIPDB: 4 reports on hosting IP 2a05:d014:58f:6200::258 (Amazon Data Services Ireland Ltd, Content Delivery Network), 1% confidence. The reports are attributed to shared infrastructure, not specifically to this website.