Verdict
This assessment found strong scam indicators. Do not pay, sign in, or share personal details with this site.
robinhood-main-dex-bhp.netlify.app shows high-risk / scam indicators.
| What this site appears to be | Netlify default 404 'Site not found' page indicating a broken link or non-existent path. No forms, monetization, or active service presented. |
|---|
Evidence status and limitations
Evidence completeness: Not recorded
- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.
At a glance
The checks that decide most of this verdict.
| Malware engines | 11 flagged itVirusTotal | Risk |
|---|---|---|
| Google Safe Browsing | Not listedGoogle | Clear |
| Abuse reports on the host | 1% confidenceAbuseIPDB, 4 reports; shared hosting inflates reports | Clear |
| Domain age | Not availableNo registration record was returned | Noted |
The page as captured
Key findings
- Automated classification: Sensitive Interaction Risk.
- At least one reputation service TrustSniffer consulted had flagged this domain at assessment time.
- The operator behind the site could not be independently connected to a real-world brand or person.
Full analysis
Security Alert
Fortinet, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.
The website is a subdomain on a free application-hosting platform. Its name pairs a well-known retail brokerage brand with the terms "main" and "dex", which suggests a decentralized-exchange-style front end. At the time of analysis it presents only the hosting platform's default "Site not found" error page. That page tells the visitor they followed a broken link and invites them to build their own site. It shows no products, pricing, company description, or monetization. The apparent purpose therefore cannot be established from its content. It looks like a placeholder or a deactivated deployment whose name borrows a financial brand.
Scam/Impersonation Risk
Contradictory signals are present. The domain is confirmed blacklisted by multiple independent threat-intelligence sources. Many scanning engines classify it as malicious, and two tier-one security vendors are among them. This external detection is decisive. The visible page shows nothing that would explain it. The hostname combines a recognised brokerage brand with a decentralized-exchange label on a free, anonymous hosting namespace. That is a pattern commonly used to stage brand-lookalike crypto-trading or wallet-connection lures. This report does not claim brand impersonation as confirmed, because no on-page brand claims were captured. However, the name invites a visitor to associate the site with the brokerage, and the site has no verifiable link to it.
Behavioral testing of the homepage also conflicts with its appearance as a static error page. All three test runs detected hidden forms, including password-type fields, although the page displays no form. The page's structure changed heavily after interaction, with a very large number of DOM mutations. Nearly all of the observed network activity went to external destinations. This pattern is consistent with content that can be swapped in or activated after load. No wallet-connection prompts, wallet-drainer behavior, clipboard hijacking, or cloaking were observed in these runs. A benign placeholder today therefore does not rule out a later switch to a credential-harvesting or wallet-interaction page. No identity contradiction exists, because the page names no legal entities.
- Homepage: shows only the platform's default "Site not found" message, with no company, product, or contact content.
- Homepage behavior: hidden forms with password fields detected in 3 of 3 sandbox runs, with 4,132 DOM mutations after interaction.
- External reputation: 11 engines flagged the domain as malicious and 2 as suspicious, including two tier-one vendors.
- Web archive: 29 snapshots over roughly 1 year tracked, so no long-standing history exists to counter the current detections.
Regulatory Verification Notes
The site provides no legal, terms, privacy, about, or licensing pages, and it claims no license, registration number, or regulatory authority. The only content is a platform error message, so there is nothing on the site to assess. Ownership and governance are both opaque, and the real-world operator is not independently connected to any person or brand, including the brokerage whose name appears in the hostname. This is a disclosure gap and not, by itself, evidence of fraud. It becomes material because the name suggests a financial service and the domain carries confirmed external detections. No third-party broker-reputation record matched this domain, which is neutral.
- Homepage: no company name, license claim, jurisdiction, or regulatory reference appears anywhere on the captured page.
- Hosting: served from AS16509 (AMAZON-02, Amazon.com, Inc., US).
- Transport encryption: TLS certificate issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 (OV, subject organization Netlify, Inc), valid to 2027-03-19. The certificate belongs to the hosting platform, not to an independently identified operator.
- Archive: 29 snapshots over roughly 1 year, with no historical identity or corporate-disclosure content.
What to Verify Next
Anyone who received this address should first establish where it came from. Messages, ads, or social posts that promoted it should be treated as suspect. Any claimed link to the brokerage should be checked by comparing the address with the brokerage's officially published domains and app listings, reached through an independent route and not through this site. Any official support or contact channel should be confirmed offline in the same way. If the address belongs to an organization's own deployment, the owner should confirm the deployment status and why the namespace is being flagged. A site owner who finds the namespace was not created by their organization should report it to the hosting platform.
- Homepage: the platform's own message ("If this is your site…") indicates the deployment is missing or unpublished, so any live content may change without notice.
- Hostname: the brand-plus-exchange wording is the main identifying artifact and can be compared against the brokerage's official domains.
- Behavioral testing: hidden password fields were present on a page that displays no form, so any later login prompt on this address would be unexpected.
Summary Verdict
The overall posture is critical and clearly cautionary. Confirmed external threat detections and anomalous hidden-form behavior outweigh the benign appearance of the placeholder page. Apparent harmlessness today does not establish legitimacy, and the operator's identity remains unverified.
Infrastructure Integrity
The site is hosted on Amazon-operated infrastructure and fronted by mainstream CDN edge servers. The observed addresses are shared edge nodes, and no origin server was observable. This is a valid, platform-managed TLS setup, but it is only a mitigating factor. Free hosting lets anyone publish under a subdomain, so the infrastructure says nothing about who operates the site. It cannot offset the external detections. Four abuse reports exist against a shared provider address. They reflect the shared platform and not necessarily this site, so they carry little weight on their own.
Closing Assessment
This address should not be used for login, credential entry, wallet connection, or any financial action. Any interaction should be limited to passive viewing, and nothing should be downloaded from it. Anyone who has already entered credentials or connected a wallet here should change those credentials and review wallet approvals immediately.
Written analysis generated 2026-10-19 by the TrustSniffer Analysis Engine from the evidence in this report.
What the analysis found
2 findings contributed to this verdict, raised by external reputation, behaviour in a sandbox.
01 External reputation
- An external threat feed lists this domain: either Google Safe Browsing marked it malicious, or a significant number of malware engines flagged it.External reputation
rule:EXT_BLACKLIST_CRITICAL
02 Behaviour in a sandbox
- The page contained a form a visitor cannot see.Behaviour in a sandbox
rule:BEHAV_HIDDEN_FORMS - Most of what the page loaded came from other domains rather than from this one.Behaviour in a sandbox
rule:BEHAV_EXTERNAL_RATIO_HIGH - The page replaced a large part of its own content after loading.Behaviour in a sandbox
rule:BEHAV_DOM_CHANGE_HIGH - The page rewrote itself after it was interacted with, so what a visitor first sees is not what they end up on.Behaviour in a sandbox
rule:BEHAV_DOM_DIFF_AFTER_INTERACTION
Signals weighed against the site
- AbuseIPDB: 4 reports on hosting IP 2a05:d014:58f:6200::258 (Amazon Data Services Ireland Ltd, Content Delivery Network), 1% confidence. The reports are attributed to shared infrastructure, not specifically to this website.
Identity verification
| Status | UNVERIFIED |
|---|---|
| Identity score | 30/100 |
| Identity verification confidence | 50% |
- No on-site identity signals detected
Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence.
What TrustSniffer observed
First-party facts recorded during the assessment of robinhood-main-dex-bhp.netlify.app.
- The request stayed on robinhood-main-dex-bhp.netlify.app. It was not redirected to another domain. Clear
Domain intelligence
| Registrar | Not available |
|---|---|
| Hosting | Not available |
| Country | Not available |
| Server IP | 2a05:d014:58f:6200::258 |
| Name servers | Not available |
| CDN / edge network | Lookup incomplete |
| SSL issuer | DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
| SSL expiry | 2027-03-19 |
| Domain age | Not available (no registration date was returned) |
| Domain expiry | Not available |
| Archive first seen | Not available |
| Archive snapshots | Not available |
| Reputation | VirusTotal: 11 flagged | AbuseIPDB: 1% confidence, 4 reports | Google Safe Browsing: 0 matches |
About this assessment
A trust score summarises the evidence TrustSniffer could collect about robinhood-main-dex-bhp.netlify.app at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.
TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.