Is robinhood-main-dex-lqx.netlify.app safe? TrustSniffer's low-trust assessment: 25/100

Security Alert

Fortinet, Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

The website is a free-tier Netlify subdomain whose hostname combines a well-known retail trading brand name with "main" and "dex" wording, which suggests a decentralized-exchange or trading front end. At capture, the page served only a generic hosting "Site not found" 404 notice and a link to the hosting provider's support guide. It shows no products, pricing, branding, or visible business model, so the purpose of the site is unclear.

Scam/Impersonation Risk

Contradictory signals are present and are confirmed. The domain is blacklisted by external threat-intelligence sources. Several independent detection engines flag it as malicious, including two tier-one security vendors. The page's own content carries no fraud wording, but the hostname borrows the identity of a prominent trading brand and adds exchange-style terminology. No on-site content ties it to that brand, and the real-world operator is unverified. Behavioral testing adds to the concern. Across all three sandbox runs, the 404 page contained concealed forms, including password-type fields. A page that visibly offers nothing should not contain these. Loading the page also triggered a very large burst of DOM changes after interaction, and nearly all of the page's requests went to external destinations. This is atypical for a static error screen and is consistent with content being swapped in or staged behind a placeholder. Third-party broker databases returned no match, so there is no separate reputational signal. No conflicting legal identities exist, because the site presents no legal pages at all. Evidence:

• Homepage: the only content is a hosting-provider "Site not found" message with no visible forms, offers, or claims.
• Sandbox behavior: hidden forms, including password-type fields, appeared in 3 of 3 runs, with 4,130 DOM mutations after interaction and up to 99.6% of requests going to external destinations.
• Archive history: 1 archive snapshot, with the first capture in 2026 and about 23 days of tracked history (domain age ~0.06 years).
• Reputation: 7 engines returned malicious verdicts, including two tier-one vendors, and an external blacklist hit is confirmed.

Regulatory Verification Notes

The site exposes no terms, privacy policy, about page, company name, licence, or registration number. The only page is a hosting error screen, so there is nothing to assess against a financial or trading regulator. The absence of disclosures is therefore a verification gap, not independent evidence of wrongdoing. Any use of a recognised brand name in the hostname carries no authorisation or affiliation. The technical certificate is the only formal credential. It is an organisation-validated certificate issued to the hosting platform, not to any operator behind the subdomain, so it does not establish who runs the site. Ownership details are incomplete, and identity remains unverified. Evidence:

• Homepage and site structure: no legal, contact, or corporate-identity pages exist, and no licence claim is made.
• Transport encryption: the TLS certificate is OV-validated, issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 to Netlify, Inc, and valid to 2027-03-19.
• Hosting: served from AS16509 (AMAZON-02, Amazon.com, Inc., US).

What to Verify Next

Any claim of affiliation with the brand suggested by the hostname should be checked only through that brand's official website, reached by typing the address directly or via an app store listing or other trusted source, not through this domain. Anyone who received this link in a message, advertisement, or social post should trace the source of that message and treat it as unsolicited until confirmed. If the site later serves real content, the operator's licence and registered entity should be checked against the relevant financial regulator's public register. Support and contact channels should be confirmed through an independent route. Any wallet-connection or login prompt appearing on this host should be reported, not completed. Evidence:

• Hostname: it contains a recognised trading brand name and "dex" wording, but no on-site content confirms any relationship.
• Homepage: no regulator, licence number, or registered entity is displayed to check.
• Threat-intelligence status: the confirmed listing means the domain should be re-checked before any future interaction.

Summary Verdict

The site is assessed as low trust with elevated risk. Confirmed external threat listings and anomalous concealed behavior outweigh the benign appearance of the page, and the real-world operator cannot be established. The evidence supports a cautionary, security-forward posture rather than any presumption of legitimacy.

Infrastructure Integrity

The site sits behind AWS-fronted CDN/WAF infrastructure. All four observed addresses are edge servers in the same Amazon network, and the origin server was not observable, so hosting cannot be independently verified. This is a mitigating factor only and does not offset the external threat detections. Two abuse reports exist against one of the shared edge addresses. They apply to infrastructure serving many tenants, carry no confidence weight, and are discounted as not specific to this site.

Closing Assessment

The domain should be treated as read-only at most. Login, credential entry, wallet connection, and any financial action should be avoided entirely. Any prior submission of credentials or approval of wallet permissions through this host should be treated as a possible compromise, followed by immediate password changes and permission revocation.

Signals weighed against the site

• AbuseIPDB: 2 reports on hosting IP 2a05:d014:58f:6200::259 (Amazon Data Services Ireland Ltd, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.