Is sol-interface.netlify.app a scam? TrustSniffer's high-risk assessment: 0/100

Overview

sol-interface.netlify.app is a subdomain on a shared static-site hosting platform. When captured, it served only a generic "Site not found" error page with a few hundred characters of text. The page shows no products, branding, operator name, or stated business purpose. The hostname suggests a crypto-style "interface" front end, but nothing on the page supports or explains that. The site's apparent purpose therefore cannot be established from its content.

Scam/Impersonation Risk

The domain carries confirmed blacklist-grade contradictions. Several independent threat-intelligence engines classify it as malicious, and one more marks it suspicious. A consolidated reputation feed also lists it, so it is blacklisted. No second legal entity appears, and no brand impersonation or phishing was observed in the page content, so this is not an identity contradiction. The behavioral evidence is also concerning. The page renders a 404 error, yet automated browser sessions repeatedly detected concealed forms, including password-type inputs, in every run. Large DOM changes followed interaction, and nearly all observed network activity went to external hosts. All of those external requests went to destinations on the standard allow-list. No wallet-connection prompts, clipboard tampering, drainer behavior, or cloaking were detected, and no contact address was published on the captured page. A parked-looking error page that still carries hidden credential-capable forms is inconsistent with a benign placeholder. It is consistent with a staging or kit page that is waiting to be activated or has been partly taken down. Evidence:

• Homepage: shows only a generic "Site not found" message, with no content describing any service.
• Homepage sandbox sessions: hidden forms, including password-type fields, were present in all three runs, and heavy DOM mutation followed interaction.
• Threat-intelligence checks: multiple engines flag the domain as malicious, and a blacklist hit is confirmed.
• Domain history: about 32 days (~0.09 years) of observed existence, with a single archive snapshot dated 2026-09-19 (1 snapshot, 1 year tracked).

Regulatory Verification Notes

No legal, terms, privacy, or about pages were captured. The only page reachable states no company name, registered address, licence, or registration number, and the operator's real-world identity is unestablished. This is a disclosure gap and is not by itself evidence of wrongdoing. Because the site is a subdomain of a shared hosting platform, the ownership trail stops at the platform and does not reach the party who deployed the site. The transport certificate belongs to the hosting platform and says nothing about who runs this site. No third-party broker or regulatory record matched, so no regulated status can be inferred. Evidence:

• Homepage: no operator name, licence, registration, or jurisdiction is stated.
• Site structure: no terms, privacy, or about pages were observed.
• Hosting: served from AS16509 (AMAZON-02, Amazon.com, Inc., US).
• TLS: certificate issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1, OV level, subject organization Netlify, Inc, valid to 2027-03-19.

What to Verify Next

The first step is to establish how the link was received and whether the sender can confirm it independently through a channel they already trust. If the link claims to represent a wallet, exchange, or protocol, its official address should be taken from that provider's own documentation, not from the message that supplied this link. If the site is expected to represent a regulated business, the operator's identity and licence should be checked in the relevant public registry. A re-check of the threat listings after a few weeks would show whether the detections persist or have been cleared. Any later reappearance of live content should be treated as a new, unreviewed site. Evidence:

• Homepage: the error text gives no way to confirm what the site was meant to be.
• Threat-intelligence checks: the current listings are the baseline for a later re-check.
• Domain history: the very short observed history leaves nothing earlier to compare against.

Summary Verdict

The overall posture is one of elevated, clearly adverse risk. Active third-party threat detections, together with concealed credential-capable form behavior on a page that presents no legitimate purpose, outweigh every neutral or favorable technical attribute. Real-world operator identity remains unknown, and nothing in the evidence supports a trusting reading.

Infrastructure Integrity

The site is served from Amazon-operated infrastructure behind a content-delivery layer. Every observed address is an edge node, and no origin server is visible. This is a mitigating factor only and does not offset the threat detections. Four edge addresses were resolved, and abuse reports exist against one of them. Because that address is shared infrastructure used by many customers, those reports cannot be attributed to this site and are a soft signal. Edge-only visibility also prevents independent hosting verification and would let the content be swapped quickly.

Closing Assessment

Interaction should be limited to passive viewing at most. No credentials, wallet connections, or payments should be entered or authorized, and nothing should be downloaded. Anyone who already interacted with the site should change reused passwords and review wallet permissions.

Signals weighed against the site

• AbuseIPDB: 4 reports on hosting IP 2a05:d014:58f:6200::258 (Amazon Data Services Ireland Ltd, Content Delivery Network), 1% confidence. The reports are attributed to shared infrastructure, not specifically to this website.