---
title: "Is crypto-xft.netlify.app Safe? Risk Report, Score 25/100"
source: TrustSniffer
type: Website trust & fraud report
subject: "crypto-xft.netlify.app"
verdict: "Low Trust"
title: "Is crypto-xft.netlify.app Safe? Warning Signs, Score 25/100"
trust_score: 25
classification_confidence: 75
canonical_url: https://trustsniffer.com/report/crypto-xft.netlify.app
assessed: 2026-10-20
---

# Is crypto-xft.netlify.app safe? TrustSniffer's low-trust assessment: 25/100

## Verdict


**Verdict: Low Trust, trust score 25/100.** crypto-xft.netlify.app is low-trust and potentially risky.

Several risk patterns were present. Do not send money or personal details until you have verified this business another way.

Labels: Sensitive Interaction Risk, Governance Risk

Assessed 2026-10-20 by automated analysis. Classification confidence 75%.

| Field | Value |
| --- | --- |
| What this site appears to be | Netlify 'Site not found' 404 error page indicating the requested path or site does not exist on Netlify hosting. No business, product, or identity content is present. |

## Evidence status and limitations


Evidence completeness: Not recorded

- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.

## At a glance

The checks that decide most of this verdict.

| Check | Result | Status |
| --- | --- | --- |
| Malware engines | 2 flagged it (VirusTotal) | Risk |
| Google Safe Browsing | Not listed (Google) | Clear |
| Abuse reports on the host | 1% confidence (AbuseIPDB, 4 reports; shared hosting inflates reports) | Clear |
| Domain age | 15 days old (Most scam domains are under a year old) | Risk |
| Web archive | Archived since 2026 (1 snapshot) | Clear |
| Certificate | Encrypted connection (Issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1) | Noted |

## The page as captured


![Screenshot of the crypto-xft.netlify.app homepage captured during the TrustSniffer assessment](https://trustsniffer.com/outputs/crypto-xft.netlify.app/screenshots/first.png)

_What crypto-xft.netlify.app served when TrustSniffer captured it on 2026-10-20. The page may look different now._

## Key findings


- Automated classification: Sensitive Interaction Risk.
- Domain age: less than 1 year (registration continuity).
- Public web-archive history exists since 2026.
- At least one reputation service TrustSniffer consulted had flagged this domain at assessment time.

## Full analysis


### Overview

This website is a subdomain on a public static-hosting platform, with a name that suggests a cryptocurrency project. It does not present a product. Its homepage returns the hosting provider's generic "Site not found" error, which says the address does not correspond to a deployed site. The page has no products, pricing, contact details or operator identity, and no business model can be inferred. Its apparent purpose is unknown. It may be a placeholder, a removed deployment, or a staging address for a crypto-themed project.


### Scam/Impersonation Risk

Active threat signals contradict the plain appearance of this page. Two threat-intelligence engines currently classify the address as malicious and one more flags it as suspicious. This is the one case in which the term **blacklisted** applies: the address has a confirmed external blacklist listing. The domain was created very recently, so no reputational history offsets these detections. The name closely resembles the hosting platform's own brand, a lookalike pattern often used to pass a page off as a platform-controlled or official property. No conflicting legal identities appear, because no identity content exists to conflict. Browser sandbox runs also behaved inconsistently with a blank error page. Hidden forms were present in all three runs, and password-type fields were detected even though no visible form or login is shown. After interaction the page's structure mutated heavily, with thousands of DOM changes. Nearly all observed network traffic went to external destinations, including external background requests and POST submissions. Those destinations were individually judged benign, but the pattern is out of character for a static 404 page. Four abuse reports exist against an address in the hosting provider's shared pool, so they attach to shared infrastructure and are weak evidence against this specific site. The sandbox findings and the threat listings are the decisive signals. A hidden credential-capture capability behind an inert-looking page is consistent with staged or cloaked phishing infrastructure, although no phishing or impersonation was confirmed. Evidence:

- The domain was first observed on 2026-10-06 and is about 13 days old, with a single archive snapshot in 1 year tracked.
- Hidden forms were detected in 3 of 3 sandbox runs, with 3 password-type fields, 15 external background requests, 21 external POST submissions and 4,130 DOM mutations after interaction.
- The homepage carries the title "Site not found" and no meta description. The hosting brand is mimicked by name only, since the content is the provider's stock error text.

### Regulatory Verification Notes

The homepage contains no legal, licensing, company or ownership information. Nothing on the page claims a financial or crypto-services license, so there is nothing to validate and nothing disclosed. A crypto-themed name with no licensing statement is a disclosure gap, not evidence of wrongdoing. The gap matters because the active threat detections elsewhere in this report point to elevated risk. The site's identity is unverified and cannot be tied to any real-world person or organisation. No third-party broker or regulatory-database record matches this name, so there is no external reputational context either way. The TLS certificate is valid and organisation-validated, but its subject is the hosting platform, not an independent operator. It therefore confirms only encrypted transport and the platform's identity. Evidence:

- The TLS certificate was issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 (OV) to Netlify, Inc, valid to 2027-03-19.
- The site is served from AS16509 (AMAZON-02 - Amazon.com, Inc., US), in US/ARIN address space.
- The homepage has no about, terms, privacy or contact content, and no social profiles are linked.

### What to Verify Next

Verification should start by establishing whether any real operator stands behind this address. Anyone who was directed to this link by a message, advertisement or social account should trace that referral back to its source. The hosting platform's abuse channel can be asked whether the deployment is active, suspended or reported, because only the platform can map the internal reference on the error page to an account. A crypto-themed project that claims an official presence should be checked against channels reached independently of this link, such as the official site of the named project. Any claimed license should be checked in the relevant regulator's public registry, and contact channels confirmed through an offline route. Evidence:

- The error page shows a platform-internal reference identifier that only the hosting provider can resolve to an account.
- The homepage has no outbound or internal links, so nothing on it can be followed to corroborate an identity.
- The homepage logged 3 console errors during sandbox runs.

### Summary Verdict

The overall posture is elevated risk. Confirmed external threat detections, recent creation, an unverified operator and concealed form behaviour outweigh the technically sound transport security. Nothing on the site offers a legitimate use that could balance these signals. The identity-uncertainty finding is a secondary concern next to the active detections.


### Infrastructure Integrity

The site sits behind the AWS edge network, and all four observed addresses belong to edge servers, so the origin server is not visible. This is typical of a hosted-platform deployment and mitigates exposure of the origin, but it also prevents independent confirmation of what is actually hosted. Content can be swapped quickly behind the edge. Protective infrastructure does not offset the reputational detections, and it is no evidence of legitimacy.


### Closing Assessment

The address should be treated as unsafe for any interaction beyond passive viewing. Credentials, wallet details and payment information should not be entered, and nothing should be downloaded from it. Anyone who has already interacted with it should change reused passwords, review wallet approvals, and report the link to the referring platform and the hosting provider.


_Written analysis generated 2026-10-20 by the TrustSniffer Analysis Engine from the evidence in this report._

## What the analysis found

5 findings contributed to this verdict, raised by external reputation, behaviour in a sandbox, hosting and network, history in the web archive, page content.

### 01 External reputation
- Several malware engines flagged this domain. (External reputation `rule:EXT_BLACKLIST_HIGH`)

### 02 Behaviour in a sandbox
- The page contained a form a visitor cannot see. (Behaviour in a sandbox `rule:BEHAV_HIDDEN_FORMS`)

### 03 Hosting and network
- The domain was registered less than three months ago. (Hosting and network `rule:DNS_NEW_DOMAIN_90D`)

### 04 History in the web archive
- The web archive has almost no record of this domain, which fits a site that is new. (History in the web archive `rule:ARCH_PEN_YOUNG_AND_SPARSE`)

### 05 Page content
- The page appears to present itself as a known brand it is not verified to belong to. (Page content `rule:PAGE_BRAND_SUSPECTED`)

### Signals weighed against the site

- AbuseIPDB: 4 reports on hosting IP 2a05:d014:58f:6200::258 (Amazon Data Services Ireland Ltd, Content Delivery Network), 1% confidence. The reports are attributed to shared infrastructure, not specifically to this website.

## Identity verification


| Field | Value |
| --- | --- |
| Status | UNVERIFIED |
| Identity score | 30/100 |
| Identity verification confidence | 50% |

- No on-site identity signals detected

_Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence._

## What TrustSniffer observed

First-party facts recorded during the assessment of crypto-xft.netlify.app.

- The request stayed on crypto-xft.netlify.app. It was not redirected to another domain. (Clear)
- The earliest public archive of this site is from 2026-10-06. (Clear)
- It is hosted on AMAZON-02, from a server in US. (Noted)

## Domain intelligence


| Field | Value |
| --- | --- |
| Registrar | Not available |
| Hosting | AMAZON-02 - Amazon.com, Inc., US |
| Country | US |
| Server IP | 2a05:d014:58f:6200::258 |
| Name servers | Not available |
| CDN / edge network | Detected (aws) |
| Resolved IP addresses | 4 |
| Edge IP addresses | 4 |
| Likely origin IP addresses | 0 |
| SSL issuer | DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
| SSL expiry | 2027-03-19 |
| Domain age | 0.04 years (continuous registration) |
| Domain expiry | Not available |
| Archive first seen | 2026-10-06 |
| Archive snapshots | 1 |
| Reputation | VirusTotal: 2 flagged \| AbuseIPDB: 1% confidence, 4 reports \| Google Safe Browsing: 0 matches |

## About this assessment


**Was this report useful?** Tell other people what you think of TrustSniffer, good or bad. An honest review helps others decide whether to rely on these checks. [Review TrustSniffer on Trustpilot](https://www.trustpilot.com/review/trustsniffer.com)

A trust score summarises the evidence TrustSniffer could collect about crypto-xft.netlify.app at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.

TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.

## Related on TrustSniffer
- [crypto-zpt.netlify.app](https://trustsniffer.com/report/crypto-zpt.netlify.app), a similar name (Low Trust, 25/100)
- [crypto-knr.netlify.app](https://trustsniffer.com/report/crypto-knr.netlify.app), a similar name (Low Trust, 25/100)
- [crypto-2fy.netlify.app](https://trustsniffer.com/report/crypto-2fy.netlify.app), a similar name (Low Trust, 26/100)
- [crypto-o0j.netlify.app](https://trustsniffer.com/report/crypto-o0j.netlify.app), a similar name (Low Trust, 27/100)
- [crypto-ens.netlify.app](https://trustsniffer.com/report/crypto-ens.netlify.app), a similar name (Low Trust, 25/100)
- [crypto-yjb.netlify.app](https://trustsniffer.com/report/crypto-yjb.netlify.app), a similar name (Low Trust, 25/100)
- [portal-moonshot-raf.netlify.app](https://trustsniffer.com/report/portal-moonshot-raf.netlify.app), a similar name (Low Trust, 25/100)
- [crypto-41u.netlify.app](https://trustsniffer.com/report/crypto-41u.netlify.app), a similar name (Low Trust, 25/100)
- [bitcoinshypertoken.web.app](https://trustsniffer.com/report/bitcoinshypertoken.web.app), another .app site assessed as low-trust (Low Trust, 34/100)
- [the-robo.web.app](https://trustsniffer.com/report/the-robo.web.app), another .app site assessed as low-trust (Low Trust, 36/100)
- [Every website and wallet TrustSniffer has assessed](https://trustsniffer.com/directory), the full risk directory
- [Other domains assessed as high-risk or phishing](https://trustsniffer.com/directory/phishing-domains), same verdict band
- [Check another website](https://trustsniffer.com/web-intelligence), run a new assessment
- [Check a crypto wallet address](https://trustsniffer.com/on-chain-risk), on-chain screening
- [The TrustSniffer Risk Index](https://trustsniffer.com/stats), how this verdict compares

## Guides
- [99.5% of flagged USDT wallets were frozen](https://trustsniffer.com/blog/99-5-of-flagged-usdt-wallets-were-frozen)
- [Trading Platform Scam: Checking a Blocked Balance](https://trustsniffer.com/blog/trading-platform-scam-checking-a-blocked-balance)
- [Connect a Wallet to a Scam Site: What Happens](https://trustsniffer.com/blog/connect-wallet-to-a-scam-site-what-happens)

---
*Source: [TrustSniffer](https://trustsniffer.com/report/crypto-xft.netlify.app) — independent automated trust & fraud analysis. Cite as https://trustsniffer.com/report/crypto-xft.netlify.app · assessed 2026-10-20.*