Verdict
This assessment found strong scam indicators. Do not pay, sign in, or share personal details with this site.
robinhood-main-dex-eht.netlify.app shows high-risk / scam indicators.
| What this site appears to be | Netlify default "Site not found" 404 page indicating a broken link or unconfigured site. No forms, no commerce, no claims or contact details present. |
|---|
Evidence status and limitations
Evidence completeness: Not recorded
- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.
At a glance
The checks that decide most of this verdict.
| Malware engines | 6 flagged itVirusTotal | Risk |
|---|---|---|
| Google Safe Browsing | Not listedGoogle | Clear |
| Abuse reports on the host | 1% confidenceAbuseIPDB, 4 reports; shared hosting inflates reports | Clear |
| Domain age | Not availableNo registration record was returned | Noted |
The page as captured
Key findings
- Automated classification: Sensitive Interaction Risk.
- At least one reputation service TrustSniffer consulted had flagged this domain at assessment time.
- The operator behind the site could not be independently connected to a real-world brand or person.
Full analysis
Security Alert
Fortinet flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.
The website is an unconfigured placeholder endpoint on a free subdomain of a developer hosting platform. A visitor sees only the platform's default "Site not found" error page, which says the link is broken or the address does not exist, and invites visitors to build their own site. The page carries no products, claims, contact details or business model. Its hostname, however, is built from a well-known retail brokerage name plus "main" and "dex", wording that suggests a crypto-trading front end.
Scam/Impersonation Risk
Contradictory signals are present, so the posture is cautionary. Multiple independent reputation sources currently flag this hostname as malicious, including a major security vendor, and that corroborated detection amounts to a confirmed blacklisting. The visible content is a harmless error page, and the page-level analysis found no brand impersonation, phishing form or wallet-drainer behaviour. The browser sandbox contradicted that benign front. In all three runs it detected hidden forms, including password-type fields, on a page that shows no visible form. It also recorded very large post-load DOM changes, heavy third-party network activity and console errors. A page that displays only a 404 but contains concealed credential-capture elements and runs substantial dynamic code is consistent with a staged or dormant lure. The hostname's evocation of a major brokerage and a "dex" product reinforces that reading, though no impersonation was confirmed. Four abuse reports exist against an address on shared cloud infrastructure. That signal is attributed to the shared provider address and not necessarily to this site, so it is context and not a finding against the operator.
- Homepage: the only visible content is a generic "Site not found" message with no forms, commerce, claims or contact details.
- Homepage, behavioural sandbox: hidden forms were detected in 3 of 3 runs, with 3 password-type forms recorded and a maximum DOM change of 4,132 mutations after interaction.
- Homepage, network activity: 36 external requests were observed, including 15 external XHR/fetch calls and 21 external POSTs, and 3 console errors were logged.
- Reputation: 6 malicious detections from independent engines, including a tier-1 security vendor, plus an external blacklist hit. The 4 abuse reports apply to a shared-provider IP.
Regulatory Verification Notes
The page contains no company name, licence, registration number, legal terms, privacy policy or contact route, so it offers nothing to assess against a regulator or registry. Real-world identity is unverified and the operator is opaque. The hostname implies a financial-trading context, but the site makes no regulatory claim, so none can be tested. No third-party broker-reputation record matched this hostname. The adverse reputation signals above are the only external reputational input, and they are reputational signals, not a licensing or legal verdict. Because the hostname suggests a trading product, any claim of authorisation would need independent confirmation with the relevant registry.
- Homepage: no operator name, licence, registration or legal disclosures are present.
- Hosting: served from AS16509 (AMAZON-02, Amazon.com, Inc., US).
- Transport encryption: the TLS certificate was issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 at OV level, subject organisation Netlify, Inc, valid to 2027-03-19. It identifies the hosting platform, not the operator of this site.
- Broker-reputation lookup: no match for this hostname.
What to Verify Next
Any claim that this address belongs to a legitimate brokerage or trading platform should be checked by independently typing the brand's official address or using its official mobile app, never a link or message pointing here. If the address came through an advertisement, message, social post or referral, the source should be treated as part of the suspected lure and its sender authenticated separately. If the address is presented as a regulated trading venue, its authorisation should be confirmed in the relevant regulator's public register. The hosting platform's abuse channel can be asked to review the deployment and the hidden form elements.
- Homepage: no official brand ownership, affiliation or link-back is displayed.
- Behavioural sandbox: hidden password-type forms on a visibly empty page are the main reason the deployment warrants a platform abuse review.
- Reputation: multiple engines currently flag the hostname, so the way the address reached the user is itself relevant.
Summary Verdict
The assessment is critical and the posture is high-risk. Confirmed multi-source threat detections combine with concealed credential-type form behaviour on an otherwise empty page and an unverified operator. The benign appearance of the visible page does not offset these findings, and nothing here supports treating the site as safe for sensitive interaction.
Infrastructure Integrity
The site is deployed on Amazon-hosted platform infrastructure, behind a content-delivery layer. All observed addresses were edge servers on Cloudflare-announced and Amazon-announced networks. No separate origin address was observed. The transport-encryption certificate is valid, but it only reflects the hosting platform's own certificate. Protective infrastructure is a mitigating factor only and does not offset the reputation risk. Shared hosting also means the abuse reports on a shared address cannot be tied specifically to this tenant.
Closing Assessment
The address should be treated as read-only at most. No login, credential entry, wallet connection, payment or financial interaction should take place on it. Anyone who arrived through an unsolicited link should discard it and use the official brand's independently obtained channels. Anyone who has already entered credentials here should change them at once and enable multi-factor authentication.
Written analysis generated 2026-10-19 by the TrustSniffer Analysis Engine from the evidence in this report.
What the analysis found
3 findings contributed to this verdict, raised by external reputation, behaviour in a sandbox, page content.
01 External reputation
- An external threat feed lists this domain: either Google Safe Browsing marked it malicious, or a significant number of malware engines flagged it.External reputation
rule:EXT_BLACKLIST_CRITICAL
02 Behaviour in a sandbox
- The page contained a form a visitor cannot see.Behaviour in a sandbox
rule:BEHAV_HIDDEN_FORMS - Most of what the page loaded came from other domains rather than from this one.Behaviour in a sandbox
rule:BEHAV_EXTERNAL_RATIO_HIGH - The page replaced a large part of its own content after loading.Behaviour in a sandbox
rule:BEHAV_DOM_CHANGE_HIGH
03 Page content
- The browser raised a warning while loading the page.Page content
rule:PAGE_BROWSER_FLAGS_SUSPICIOUS
Signals weighed against the site
- AbuseIPDB: 4 reports on hosting IP 2a05:d014:58f:6200::258 (Amazon Data Services Ireland Ltd, Content Delivery Network), 1% confidence. The reports are attributed to shared infrastructure, not specifically to this website.
Identity verification
| Status | UNVERIFIED |
|---|---|
| Identity score | 30/100 |
| Identity verification confidence | 50% |
- No on-site identity signals detected
Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence.
What TrustSniffer observed
First-party facts recorded during the assessment of robinhood-main-dex-eht.netlify.app.
- The request stayed on robinhood-main-dex-eht.netlify.app. It was not redirected to another domain. Clear
Domain intelligence
| Registrar | Not available |
|---|---|
| Hosting | Not available |
| Country | Not available |
| Server IP | 2a05:d014:58f:6200::258 |
| Name servers | Not available |
| CDN / edge network | Lookup incomplete |
| SSL issuer | DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
| SSL expiry | 2027-03-19 |
| Domain age | Not available (no registration date was returned) |
| Domain expiry | Not available |
| Archive first seen | Not available |
| Archive snapshots | Not available |
| Reputation | VirusTotal: 6 flagged | AbuseIPDB: 1% confidence, 4 reports | Google Safe Browsing: 0 matches |
About this assessment
A trust score summarises the evidence TrustSniffer could collect about robinhood-main-dex-eht.netlify.app at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.
TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.