Is robinhood-main-dex-vtc.netlify.app safe? TrustSniffer's low-trust assessment: 25/100

Overview

The website is a Netlify-hosted subdomain whose name pairs a well-known retail brokerage brand with the terms "main", "dex" and "vtc". Its landing page is the hosting platform's default "Site not found" error, with no products, pricing, claims or visible operator. Its apparent purpose cannot be established from visible content. The name suggests a decentralized-exchange or trading front end that may borrow a recognised financial brand.

Scam/Impersonation Risk

Several independent contradictions are present, and the posture is clearly cautionary. Multiple threat-intelligence engines currently flag the domain as malicious or suspicious, and the domain is blacklisted by external reputation sources. The hostname embeds a prominent financial brand and sits on a free hosting namespace. That is a pattern commonly used for brand-lookalike lures. Page analysis also flags a suspected brand lookalike. No conflicting legal identities were found, and no phishing verdict was confirmed. The visible 404 page is not the real risk. During sandbox browsing the site repeatedly loaded hidden forms that included password fields, although the page shows no visible login. Its page structure also changed heavily after interaction, and almost all outbound network activity went to external destinations. A hidden credential-capture surface behind an empty-looking page is consistent with a staging or cloaked lure. Two abuse reports exist against one of the shared infrastructure addresses. They relate to the hosting provider's shared network rather than to this site, so they were discounted and carry no weight in this assessment. Evidence:

• Homepage: the page is a default hosting 404 with no service description, forms or claims, yet the sandbox found hidden forms with password fields in all three of three browsing runs.
• Homepage behaviour: roughly 4,130 page-structure mutations were recorded after interaction. The share of external requests peaked at 99.6%, and the sandbox flagged the network pattern as suspicious.
• Domain provenance: the domain is about 23 days old (first archived 2026-09-27), with 7 archive snapshots across a single year.
• Reputation: 5 engines rated the domain malicious and 2 suspicious. The two abuse reports are attributed to shared CDN infrastructure and were discounted.

Regulatory Verification Notes

The site claims no licence, registration number, regulator or legal entity anywhere. The only page content is the hosting platform's own error text. No terms, privacy, about or contact page exists to examine. The real-world operator therefore cannot be connected to any person or company, and no brand claim supports the financial-brand name in the hostname. This is a disclosure gap. Taken alone it would not indicate wrongdoing, but here it compounds the reputational contradictions above. No third-party broker or regulatory dataset corroborates the site, so no external signal offsets the gap. Evidence:

• Homepage: no legal entity, licence authority or licence number is stated, and no legal pages are present.
• Hosting infrastructure: served from AS16509 (AMAZON-02, Amazon.com, Inc., US), a general-purpose cloud network that says nothing about the operator's identity.
• Transport encryption: the TLS certificate is OV-level, issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 to Netlify, Inc, valid to 2027-03-19. It authenticates the hosting platform, not the site's operator.

What to Verify Next

Do not treat any page or workflow on this domain as part of a genuine brokerage. If the name is associated with a financial brand, its legitimate domain should be obtained independently through the brand's official application listing or regulatory registry entry. The origin of any link that led here should be traced and treated as suspect until proven otherwise. If the link arrived by message, social post or advertisement, report it to the sender platform and to the impersonated brand's security team. An organisation that suspects its own resources were deployed here should review its hosting account and request takedown through the platform's abuse channel. Evidence:

• Homepage: the page shows no operator, so legitimacy has to be established from sources outside this site.
• Hostname: the embedded brand term and the free hosting namespace are the points of comparison for any brand-owner check.
• Sandbox findings: the hidden password-bearing forms mean any credential entered on a lookalike flow could be captured.

Summary Verdict

The assessment is low trust with elevated risk. Active blacklist-level reputation signals, a young domain, a brand-lookalike hostname and hidden credential forms behind an empty page converge on a cautionary conclusion. The valid encryption certificate and stable page responses are real but do not offset these contradictions. The operator's identity remains unverified.

Infrastructure Integrity

All observed addresses belong to Amazon-operated edge infrastructure, and the origin server is not observable. The site is served through a reputable cloud and CDN layer with a valid certificate. That is a mitigating factor only, because such platforms host both legitimate and abusive content. Edge-only visibility prevents independent confirmation of what actually serves the content. It also allows the content behind the same hostname to be swapped quickly.

Closing Assessment

At most, the site should be viewed read-only. Logins, credentials and financial interactions should be avoided entirely. Any link, wallet connection or form that leads here should be treated as untrusted until the operator is independently confirmed.

Signals weighed against the site

• AbuseIPDB: 2 reports on hosting IP 2a05:d014:58f:6200::259 (Amazon Data Services Ireland Ltd, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.