Is robinhood-main-dex-psg.netlify.app a scam? TrustSniffer's high-risk assessment: 0/100

Overview

This website is a subdomain on a shared, free application-hosting platform. At the time of analysis it served only the platform's generic "Site not found" error page, with no products, services, contact details or business content. Its hostname combines a well-known retail brokerage name with decentralized-exchange terminology, which implies a crypto trading front end. The reachable page itself has no visible purpose or business model beyond a generic invitation to "Start building" on the hosting platform.

Scam/Impersonation Risk

Hard contradictory signals are present, and the posture is cautionary. Multiple independent threat-intelligence engines classify the domain as malicious, and the combined external reputation checks amount to a confirmed blacklist listing. The hostname embeds a major financial brand name alongside "dex" wording, hosted on a free shared subdomain rather than on any domain the brand would plausibly operate. Nothing on the page ties the site to that brand. Brand impersonation is therefore not confirmed. The pairing of a brand-style name with a throwaway hosting address is a recognized pattern for staging credential-harvesting or wallet-drainer pages. The page's behavior reinforces the concern. The visible page is a bare error screen, yet in every sandbox run it contained concealed form structures, including password-type fields, and its content changed substantially after interaction. Its network traffic was almost entirely directed to external destinations, and the final destination did not match the requested one. A static 404 page should not behave this way, which suggests content or forms that may be activated selectively. Two abuse reports exist against one of the shared edge addresses. They are discounted because they relate to infrastructure shared with many unrelated tenants, not to this site specifically. No conflicting legal identities were found, and no phishing or threat-feed listing identifies the site as distributing malware. Evidence:

• Homepage: five threat-intelligence engines flagged the domain as malicious, and an additional external blacklist confirmed the listing.
• Homepage sandbox: hidden forms were detected in all three of three runs, including three password-type form instances, on a page whose visible content is only a 404 notice.
• Homepage sandbox: DOM mutations reached 4,130 after interaction, with 99.6% of network activity directed externally and a final-destination mismatch flagged.
• Hostname: the brokerage-style name and "dex" wording sit on a free shared subdomain of the hosting platform, which the page analysis flagged as a lookalike pattern.

Regulatory Verification Notes

The reachable page carries no legal, terms, privacy, about or licensing content. No license, registration number or regulated-entity claim is made, and no regulatory authorization is independently evidenced for any financial activity implied by the hostname. This is a verification gap, not proof of fraud on its own. Ownership opacity applies here and is distinct from an identity contradiction. The real-world operator cannot be linked to any named brand or person, so identity remains unverified. No third-party broker-intelligence record matched this site. The valid, organization-validated certificate belongs to the hosting platform, so it does not evidence the operator's identity. Evidence:

• Homepage: no company name, license, registration number or legal disclosure is shown; the only content is a hosting error notice.
• Transport encryption: the TLS certificate is OV-validated, issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 to Netlify, Inc, and valid to 2027-03-19.
• Hosting: served from AS16509 (AMAZON-02, Amazon.com, Inc., US).

What to Verify Next

Before any engagement, the site's claimed link to the brokerage brand should be tested through that brand's own official channels, not through anything on this site. A genuine operator would publish its decentralized-exchange offering on the brand's primary, officially announced domain. A contact or support channel should also be confirmed offline through an independent route. If any financial service is later offered here, the operator's licensing status should be checked directly with the relevant financial regulator's public register. Any link that led a user to this address should be traced back to its source, such as a message, advertisement or social post, and treated as suspect. Evidence:

• Hostname: it references a major brokerage brand on a free shared subdomain, so only the brand's officially published domain is a valid reference point.
• Homepage: no operator name, registry entry or contact route is available to confirm independently.
• Homepage sandbox: concealed password-type fields were detected, so no login should be attempted while the origin of the page is unresolved.

Summary Verdict

Reputation intelligence and sandbox behavior converge on an elevated-risk assessment that overrides the technically valid encryption and the mainstream hosting provider. The site shows hallmarks of a staging or phishing-style asset, and no operator identity has been established.

Infrastructure Integrity

The site is served through AWS-based content-delivery edge infrastructure that sits in front of the hosting platform. All four observed addresses are edge nodes, and the origin server could not be observed. This prevents independent verification of the true hosting location and can mask rapid content swaps. The platform's mainstream provider, trusted edge network and valid certificate are mitigating factors only. They show that the platform is reputable, not that this tenant is legitimate, and they cannot offset the reputation findings.

Closing Assessment

The site should not be used for login, credential entry, wallet connection or any financial transaction, and any such activity already attempted through it should be treated as potentially compromised. Interaction should be limited to read-only viewing, and any link that led here should be reported and discarded.

Signals weighed against the site

• AbuseIPDB: 2 reports on hosting IP 2a05:d014:58f:6200::259 (Amazon Data Services Ireland Ltd, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.