Is bitnestwebapp.vercel.app safe? TrustSniffer's low-trust assessment: 27/100

Overview

BitNest is a single-page web application that presents itself under the title "BITNEST" and is served from a free subdomain on a shared application-hosting platform rather than from a dedicated, independently registered domain. The page carries a substantial amount of interactive, script-driven content, and its apparent purpose is a crypto or finance-style web app front end. No further description of its products could be confirmed from the captured evidence.

Scam/Impersonation Risk

The site shows hard contradictory signals. It is blacklisted by threat-intelligence sources. Several independent security engines flag the domain as malicious or suspicious, and a separate external blacklist corroborates this. Archive-side reputation data also marks the domain as previously associated with phishing. No brand impersonation or conflicting legal identities were observed, and no published contact artifacts were captured. The reputation evidence alone is enough for a cautionary posture. Abuse reports recorded against the site's IP address do not count against it. That address belongs to a shared provider range, so the reports concern other tenants and have been discounted. The site's own page behaviour is mixed. Sandbox runs showed no calls to external domains, no wallet-drainer or clipboard-hijack activity, no hidden forms, and no cloaking. However, the page produced repeated console errors and very large DOM rewrites after interaction, so the interface rebuilds heavily once a visitor engages with it. That fits a script-driven app. It also means what is shown on first load may not match what appears after interaction. Because the blacklisting is decisive, a financial or credential-bearing workflow on this site carries elevated risk. Evidence:

• Homepage: three security engines classed the domain as malicious and one as suspicious, and an external blacklist also lists it.
• Homepage behaviour: across three sandbox runs, 14 console errors and up to 1,954 DOM mutations after interaction, with zero external network calls.
• Hosting IP: 94 abuse reports were attributed to the shared-provider address and discounted, so they were not counted against the site.

Regulatory Verification Notes

The captured page does not make clear which legal entity operates it, and no licence, registration number, or regulator reference could be identified on it. This is a disclosure gap that blocks any assessment of the operator's regulatory standing. By itself it is not evidence of fraud, but here it compounds the reputation findings. Operator identity could not be independently connected to any real-world business or person, so legitimacy cannot be treated as established. No third-party broker or regulator listing matched this site, so there is neither a reputational nor a regulatory signal from that route. Evidence:

• Homepage: no legal entity name, licence, or registration reference was found in the captured page text.
• Hosting: served from AS16509 (AMAZON-02, Amazon.com, Inc., US), on a shared platform subdomain.
• Transport encryption: TLS certificate issued by WR1 (DV, domain validation only), valid to 2026-11-27, with 31 days remaining. DV confirms domain control only, not the operator's identity.

What to Verify Next

Until the blacklisting is resolved, the site should not be used for login, credentials, or financial activity. The operator should be identified through an independent route, such as the platform provider's abuse channel or an official, separately sourced announcement from the claimed brand. If the site claims any licence or registration, it should be checked directly at the issuing registry. Official support and contact channels should be confirmed independently, not through links on the site. Anyone who has already interacted with the site should review wallet approvals and account credentials. Evidence:

• Homepage: there is no verifiable operator or licence reference to check, so any claim must come from outside the site.
• Reputation findings: the malicious classifications are current and should be re-checked before any reassessment.
• Page behaviour: the post-interaction DOM rewrites mean first-load content should not be treated as representative.

Summary Verdict

The site carries an elevated risk posture. Confirmed threat-intelligence listings are decisive, and nothing in the evidence offsets them. Its technical hygiene is basic: valid encryption, a clear hosting provider, and no observed external data exfiltration. That does not establish legitimacy or a verified operator. The overall assessment is clearly cautionary.

Infrastructure Integrity

The site is delivered through a CDN/WAF layer on a major cloud provider's network, with several edge addresses in the same range. The true origin server was not observable, so hosting cannot be independently verified. This setup is a mitigating factor only, and it cannot offset the reputation findings. Edge-only visibility also makes quick content swaps harder to detect.

Closing Assessment

Treat the site as suitable at most for passive, read-only viewing, and avoid entering credentials, connecting wallets, or making any payment or deposit until the threat listings are cleared and the operator is independently identified.

Signals weighed against the site

• AbuseIPDB: 94 reports on hosting IP 216.198.79.131 (Vercel, Inc, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.