Verdict
This assessment found strong scam indicators. Do not pay, sign in, or share personal details with this site.
robinhood-main-dex-dlr.netlify.app shows high-risk / scam indicators.
| What this site appears to be | Generic Netlify 404 'Site not found' page indicating the requested site or path does not exist on that hosting platform. No forms, claims, or commercial content are present. |
|---|
Evidence status and limitations
Evidence completeness: Not recorded
- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.
At a glance
The checks that decide most of this verdict.
| Malware engines | 17 flagged itVirusTotal | Risk |
|---|---|---|
| Google Safe Browsing | Not listedGoogle | Clear |
| Abuse reports on the host | 1% confidenceAbuseIPDB, 4 reports; shared hosting inflates reports | Clear |
| Domain age | Not availableNo registration record was returned | Noted |
The page as captured
Key findings
- Automated classification: Sensitive Interaction Risk.
- At least one reputation service TrustSniffer consulted had flagged this domain at assessment time.
- The operator behind the site could not be independently connected to a real-world brand or person.
Full analysis
Security Alert
Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.
This website is a subdomain on a public web-hosting platform whose name combines a well-known retail brokerage brand with the terms "main" and "dex", which suggests a brand-styled decentralized-exchange or trading front end. The only content it presents to a visitor is the hosting platform's generic "Site not found" error page. That page has no products, claims, forms or commercial content, so no business model is visible. The domain name and the behaviour recorded during testing are the only indications of its intended purpose.
Scam/Impersonation Risk
This is the most serious area of concern. Confirmed contradictions are present: several major security vendors currently flag the site as malicious, and the combined detections amount to a confirmed blacklisting from external threat intelligence. The domain name pairs a household financial brand with an exchange-style label on a free third-party hosting namespace, and nothing connects the site to that brand's real operator. Automated analysis did not confirm brand impersonation, and no conflicting legal identities were found. The naming pattern is still consistent with lookalike infrastructure and calls for a cautionary reading. The static page gives no sign of danger, but behavioural testing contradicts it. In all three sandbox runs the site loaded hidden forms, including password-type fields, behind the error page. Its page structure also changed very heavily after interaction, and almost all of its network activity went to external destinations. A genuine "site not found" placeholder would not be expected to behave this way. This is consistent with content that is staged, conditionally served, or swapped in after the page loads. Separately, four abuse reports exist against an address on the shared provider infrastructure. Those reports describe shared hosting rather than this site specifically, so they are corroborating context only and not an independent finding. Evidence:
- Homepage: the visible content is only a generic hosting-platform 404 notice with a platform support-guide reference and an invitation to "start building". There is no brand content, but the domain name itself invokes a well-known financial brand.
- Sandbox behaviour: hidden forms were detected in 3 of 3 runs, along with 3 password-type forms. Roughly 4,100 page mutations followed interaction, and external traffic reached about 99.6% in the peak run.
- Archive provenance: a single archive snapshot exists, with first and last sightings both on 2026-10-10. This shows a very recent, thin public history for the site.
- Threat intelligence: multiple security engines, including several tier-one vendors, classify the site as malicious. A kill switch was triggered and the site's score was capped.
Regulatory Verification Notes
The site discloses no operator, legal entity, licence, registration number, terms or privacy page, and its ownership and governance remain opaque. Identity cannot be independently tied to any real-world brand or person, and no regulated status was found through any third-party source. A broker-reputation lookup returned no match. That is not an adverse finding in itself, but it leaves no regulatory standing to offset the threat-intelligence detections. The domain name implies exchange and brokerage activity, and a service of that kind would ordinarily be expected to carry visible licensing and corporate disclosures. The valid transport-encryption certificate does not change this. It was issued to the hosting platform, not to the operator of this site, and so says nothing about who controls the content. Evidence:
- Hosting: served from AS16509 (AMAZON-02, Amazon.com, Inc., US), under the ARIN registry.
- TLS: certificate issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 at OV level, with subject organisation "Netlify, Inc" and validity to 2027-03-19 (about 151 days remaining). This is the platform's certificate, not an operator identity.
- DeFi recognition: the site is not listed in any decentralized-finance protocol directory, so there is no TVL or market-cap evidence to support the exchange-style name.
- Homepage: contains no company name, licence, registry reference or legal pages.
What to Verify Next
The first step is to confirm, through the brokerage brand's own official website or app and not through this address, whether it operates any service under this name. If it does not, treat the site as unaffiliated. Anyone who received a link to this address should identify the channel it came from, such as a message, advertisement or social post, and treat that channel as suspect. Any claim of exchange or brokerage services should be checked against the relevant financial regulator's public register before any engagement. Official support channels should be confirmed independently, through a route that does not originate from this site. Anyone who has already entered credentials or connected a wallet here should rotate those credentials and review account and wallet permissions. Evidence:
- Homepage: the static page offers no way to identify who is behind the site or whether it is connected to the brand it resembles.
- Sandbox behaviour: the hidden password-type forms found during testing mean that any credential entry on this address is a potential exposure.
- Threat intelligence: the current malicious classification means there is no basis for assuming the content is benign.
Summary Verdict
The available evidence supports a high-risk posture. Active external threat detections are corroborated by behaviour inconsistent with the site's blank appearance, and the lack of any verified operator identity gives no counterweight. The site must not be treated as an authentic or affiliated financial service.
Infrastructure Integrity
The site is hosted in the United States on Amazon infrastructure, and its observed addresses are all content-delivery edge servers, with no origin server identified. These protections are standard, and the hosting platform's certificate is valid and current. They are a mitigating factor only and do not offset the reputational risk from the external detections. Because the infrastructure is shared, it also says little about the site's own operator.
Closing Assessment
Use of this address should be limited to passive, read-only inspection by security personnel in an isolated environment. Credentials, wallet connections, payment details and financial transactions should not be submitted, and the address should be blocked or reported where the organisation's policy allows.
Written analysis generated 2026-10-19 by the TrustSniffer Analysis Engine from the evidence in this report.
What the analysis found
2 findings contributed to this verdict, raised by external reputation, behaviour in a sandbox.
01 External reputation
- An external threat feed lists this domain: either Google Safe Browsing marked it malicious, or a significant number of malware engines flagged it.External reputation
rule:EXT_BLACKLIST_CRITICAL
02 Behaviour in a sandbox
- The page contained a form a visitor cannot see.Behaviour in a sandbox
rule:BEHAV_HIDDEN_FORMS - Most of what the page loaded came from other domains rather than from this one.Behaviour in a sandbox
rule:BEHAV_EXTERNAL_RATIO_HIGH - The page replaced a large part of its own content after loading.Behaviour in a sandbox
rule:BEHAV_DOM_CHANGE_HIGH - The page rewrote itself after it was interacted with, so what a visitor first sees is not what they end up on.Behaviour in a sandbox
rule:BEHAV_DOM_DIFF_AFTER_INTERACTION
Signals weighed against the site
- AbuseIPDB: 4 reports on hosting IP 2a05:d014:58f:6200::258 (Amazon Data Services Ireland Ltd, Content Delivery Network), 1% confidence. The reports are attributed to shared infrastructure, not specifically to this website.
Identity verification
| Status | UNVERIFIED |
|---|---|
| Identity score | 30/100 |
| Identity verification confidence | 50% |
- No on-site identity signals detected
Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence.
What TrustSniffer observed
First-party facts recorded during the assessment of robinhood-main-dex-dlr.netlify.app.
- The request stayed on robinhood-main-dex-dlr.netlify.app. It was not redirected to another domain. Clear
Domain intelligence
| Registrar | Not available |
|---|---|
| Hosting | Not available |
| Country | Not available |
| Server IP | 2a05:d014:58f:6200::258 |
| Name servers | Not available |
| CDN / edge network | Lookup incomplete |
| SSL issuer | DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
| SSL expiry | 2027-03-19 |
| Domain age | Not available (no registration date was returned) |
| Domain expiry | Not available |
| Archive first seen | Not available |
| Archive snapshots | Not available |
| Reputation | VirusTotal: 17 flagged | AbuseIPDB: 1% confidence, 4 reports | Google Safe Browsing: 0 matches |
About this assessment
A trust score summarises the evidence TrustSniffer could collect about robinhood-main-dex-dlr.netlify.app at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.
TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.