Is donutclientss.netlify.app a scam? TrustSniffer's high-risk assessment: 0/100

Overview

The captured homepage of this Netlify-hosted subdomain is a generic "Site not found" error page with only a few hundred characters of text. It shows no products, brand, services or business model. The address resolves to a free-form subdomain on a shared static-hosting platform, and no operator or commercial purpose can be read from what the page shows. Its apparent purpose is therefore indeterminate.

Scam/Impersonation Risk

The evidence contains confirmed adverse reputation signals. Several independent threat-intelligence engines classify the domain as malicious or suspicious, and it also carries an external blacklist listing. These are the decisive findings, and they support a clearly cautionary posture. No brand impersonation, conflicting legal identities or confirmed phishing page were observed. The page content supplied nothing to examine for those, because it is an error page. Automated browser sessions did show behavior that does not fit a dormant error page. Hidden form elements, including password-type fields, were present in every session. The page also produced very heavy DOM rewriting after interaction, and almost all network activity went to external destinations. Wallet-connection prompts, clipboard tampering, fingerprinting and content cloaking were not observed. A hosted subdomain that carries concealed credential-capture-capable forms behind a "not found" front, and is already listed by threat-intelligence sources, matches a staging or credential-harvesting pattern. This is an inference from the behavior, not a confirmed phishing finding. Two abuse reports were also recorded against a provider-operated address in the same hosting range. They are discounted, since they relate to shared provider infrastructure and are not attributable to this site. Evidence:

• Homepage: the captured page returned a "Site not found" error with minimal text, so no product, brand or identity claims could be assessed.
• Behavioral sessions: hidden forms were detected in 3 of 3 runs, with 3 password-type forms, 21 outbound POST requests, and up to 99.6% of requests going to external hosts.
• Behavioral sessions: 4,130 DOM mutations followed interaction on the otherwise near-empty page.
• Reputation sources: 2 engines rated the domain malicious and 1 suspicious, alongside an external blacklist hit. The 2 abuse reports relate to a shared provider address and are discounted.

Regulatory Verification Notes

No legal, terms, privacy or about content was available on the captured page. No licence, registration number or corporate entity is therefore disclosed, and the site cannot be linked to any real-world organisation. That alone would be a verification gap rather than proof of wrongdoing, but here it coincides with the adverse reputation findings above. The TLS certificate is organisation-validated, but its subject is the hosting platform and not the site's operator. It confirms encrypted transport and says nothing about who runs the site. No broker-reputation record was matched, and no third-party regulatory standing was established. Evidence:

• Homepage: no company name, licence, registration number or legal documentation appeared on the captured page.
• Transport encryption: the certificate was issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 (OV), names Netlify, Inc as subject, and is valid to 2027-03-19.
• Hosting: the site is served from AS16509 (AMAZON-02, Amazon.com, Inc., US).

What to Verify Next

Any contact with this address should start from an independently sourced route to the supposed operator. Confirm through a separately known, offline channel whether the organisation or person behind this subdomain exists. Check with the hosting platform's abuse process whether the deployment is a known project or has been reported. Re-test the address after the owner has had a chance to remove the hidden forms and the reputation listings. Any official support or contact details should be taken from an authoritative source outside this site. Evidence:

• Homepage: the error page offers no verifiable operator, so independent identification is the only available route.
• Behavioral sessions: the hidden password-type forms reappeared in every run, so a single clean re-test would not be conclusive.
• Reputation sources: the listings are current and would need to be delisted before the address can be reassessed.

Summary Verdict

Available evidence places this site in an elevated-risk category. Confirmed negative reputation findings and concealed credential-capable form behavior outweigh the technical hygiene signals, and no real-world operator identity could be established. The site should be treated as unsafe for any sensitive interaction.

Infrastructure Integrity

The site is delivered through Amazon-operated edge infrastructure, and the observed addresses are all provider edge servers. The origin server was not observable. This is protective, mainstream infrastructure and a mild mitigating factor, but it is shared and gives no assurance about the site's operator. It cannot offset the reputation findings, and edge-only visibility can mask rapid content changes behind the same address.

Closing Assessment

Limit interaction to passive viewing at most. Do not enter credentials, log in or make any payment or financial transaction on this site until the operator has been independently identified and the threat-intelligence listings have been cleared.

Signals weighed against the site

• AbuseIPDB: 2 reports on hosting IP 2a05:d014:58f:6200::259 (Amazon Data Services Ireland Ltd, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.