Is robinhood-main-dex-mqt.netlify.app a scam? TrustSniffer's high-risk assessment: 0/100

Overview

The website is a Netlify-hosted subdomain whose name pairs the Robinhood brokerage brand with the phrase "main dex," which suggests a decentralized-exchange or crypto-trading front end. When visited, it shows only Netlify's generic "Site not found" 404 page. That page has no products, services, branding, login or commercial content, so no business model can be read from it. The apparent purpose is therefore inferred from the hostname alone, and the site itself does not confirm it.

Scam/Impersonation Risk

Contradictory signals are present, and they drive a clearly cautionary posture. Multiple independent security engines classify the site as malicious, and an external blacklist also lists it. Both are confirmed blacklist hits against this hostname, and they are the decisive reason the site is rated at the lowest trust level. The hostname embeds the name of a well-known retail brokerage next to a "dex" label. This lookalike pattern is commonly used to lure users toward fake trading or wallet-connection pages, and the page analysis also flagged brand suspicion. Nothing on the captured page confirms or refutes an affiliation with that brand, and no conflicting legal entities were observed. The behavioral findings are more concerning than the page text. A page that presents only a static 404 message still produced three hidden forms across all three sandbox runs, and all three included password fields. It also produced very heavy DOM activity after interaction. The 404 content and the hidden credential-capable forms do not match. That mismatch is consistent with a placeholder that can be swapped for a credential-harvesting page. Network activity was assessed as largely benign, and no wallet-drainer, clipboard-hijack or cloaking behavior was recorded. Evidence:

• Homepage: the only content captured is a generic hosting-platform 404 message with no stated purpose, operator or product.
• Homepage sandbox runs: hidden forms with password fields were detected in all three runs, along with more than four thousand DOM mutations after interaction.
• Domain provenance: the hostname first appeared in web archives on 2026-09-27 (about 23 days old), with 6 snapshots over 1 year tracked.
• DeFi directory check: the hostname is not recognized as a listed DeFi protocol, so no TVL or market-cap figure exists to support any exchange-related claim.

Regulatory Verification Notes

The captured page has no terms, privacy policy, about page, company name, licence, registration number or regulatory reference. Ownership and governance are opaque, and the real-world operator is unverified. Any claim to be an exchange, broker or financial service would therefore have no on-site disclosure behind it. Third-party broker-reputation data returned no match for this site, so no external regulatory standing is available either. The transport-encryption certificate is valid, but it is an organization-validated certificate held by the hosting platform, not by whoever operates this subdomain. It confirms an encrypted connection and says nothing about who the operator is. Evidence:

• Homepage: no legal, identity, licensing or contact disclosures appear on the captured page.
• Hosting infrastructure: served from AS16509 (Amazon), with the origin appearing in the United States.
• Transport encryption: TLS certificate issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 (OV) to Netlify, Inc, valid to 2027-03-19.

What to Verify Next

Before any interaction, the claimed link to the Robinhood brand should be checked against the brand's own officially published domains and app channels, reached independently and not through this site or any message that pointed to it. Anyone who arrived through an ad, social post, message or search result should find where that referral came from and treat the source as suspect. Any exchange or trading service the site later claims to offer should be checked in the relevant financial regulator's public register. Support channels should be confirmed only through the genuine brand's official website. Anyone who has already entered credentials or connected a wallet here should change those credentials immediately and review wallet permissions. Evidence:

• Hostname: the brand name in the subdomain is not backed by any content on the captured page.
• Homepage behavior: the hidden password-bearing forms mean any data entered after the page changes could be captured.
• Reputation checks: several security engines currently flag the hostname, so the referring source also deserves scrutiny.

Summary Verdict

The site is rated at the lowest trust level, with a clearly high-risk posture. Confirmed blacklist listings, a brand-evoking financial hostname, hidden credential-capable forms behind a bare placeholder page, and unverified ownership converge on the same conclusion. The few technical positives, such as a valid certificate, cannot offset this.

Infrastructure Integrity

The site is delivered through Amazon Web Services infrastructure fronting Netlify's hosting platform, and all observed addresses are edge servers, so the true origin is not visible. This is mitigating at most. It shows a mainstream, well-run platform and says nothing about the legitimacy of the content deployed to it. Because the platform is shared, content on this subdomain can be changed quickly without any visible infrastructure change. Four abuse reports exist against one of the shared edge addresses. These are attributed to the shared platform and not specifically to this site, so they are weak evidence on their own.

Closing Assessment

The site should not be used for login, credential entry, wallet connection or any financial activity. Any link to it should be treated as untrusted, and any account that may have been exposed should be secured immediately. Anyone seeking the genuine brand's services should navigate directly to its officially published channels.

Signals weighed against the site

• AbuseIPDB: 4 reports on hosting IP 2a05:d014:58f:6200::258 (Amazon Data Services Ireland Ltd, Content Delivery Network), 1% confidence. The reports are attributed to shared infrastructure, not specifically to this website.