Is coolwalletdesktop.app a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

CoolWallet Desktop is a single-page product landing site promoting a free desktop companion application for CoolWallet hardware wallets. It offers downloads for Windows and macOS. The page presents portfolio tracking, transaction review, Web3 application connections, device and firmware management, and listings of third-party crypto buy/sell providers. It appears to be a software front-end for a hardware-wallet ecosystem. The hardware device is presumably the main revenue source, with possible referral income from the listed providers.

Scam/Impersonation Risk

No contradictions were observed in the sense that matters for impersonation analysis. The homepage shows no brand-impersonation indicators, no conflicting legal identities, and no phishing mechanics. It has no login form, no hidden forms, no sensitive data entry, and no external form submissions. It states that recovery phrases are never requested, and it makes no yield or return promises. Its dashboard mock-up of a large portfolio is explicitly labelled as illustrative, which is consistent with a marketing preview rather than a deceptive balance display. A minor internal inconsistency exists: the mock activity feed shows a swap into USDC while the portfolio panel lists USDT. The signals that drive the elevated risk assessment are separate from impersonation. One major security vendor currently flags the domain as malicious. Automated behavioral analysis also recorded a malware-execution indicator, although the same sessions showed no external network activity, no script anomalies, and no cloaking. The attribution of these detections is not specified. They are therefore treated as an unresolved soft third-party warning and reputation note, not as a confirmed listing or a hard finding. The domain is also only weeks old, which is an unfavourable context for a product whose installers are meant to sit beside a user's crypto assets. Evidence:

• Homepage: no login, password, or sensitive-data form is present. Automated sessions recorded zero external POST or XHR requests.
• Homepage: dashboard figures are labelled "Interface preview. Balances and activity shown are illustrative", and the portfolio panel (USDT) conflicts with the activity feed (USDC).
• Homepage: the Windows and macOS download buttons are the main interaction surface, and the file integrity and origin of those downloads were not assessed here.
• Domain provenance: registered about 19 days before analysis (~0.05 years old). The web archive holds 2 snapshots, both from late September 2026 (1 year tracked).

Regulatory Verification Notes

The page identifies no operating legal entity, registered address, or licensing or registration reference. Contact is limited to a live-chat widget. For a non-custodial wallet application, a financial licence is not necessarily expected. The absence of corporate identification is nonetheless a disclosure gap in a category where users install software that handles signing authority. Ownership details are also incomplete, and identity verification is unverified (score 30, confidence 0.5, no supporting signals). The available evidence therefore does not allow the real-world operator to be independently connected to the CoolWallet brand. No third-party broker or regulatory-register record matched this domain. This is treated as neutral context and not as a finding. Evidence:

• Homepage: no company name, address, licence, or registration number is published, and no dedicated legal, terms, or about page was captured.
• Homepage: the only contact route observed is a live-chat widget.
• Hosting: served from AS16509 (AMAZON-02 - Amazon.com, Inc., US).
• Transport security: TLS certificate issued by YR2 (DV, domain validation only), valid to 2026-12-29 with 70 days remaining. A DV certificate confirms control of the domain, not the operator's identity.

What to Verify Next

The first step is to establish whether this domain is an official CoolWallet property. That means checking the desktop-app link from the manufacturer's own website or product packaging, or through its documented support channel, rather than relying on this domain's self-description. The second step is to confirm, through that same route, that the Windows and macOS installers are published by the manufacturer. Any installer should then be checked against a publisher-supplied checksum or signature before it is run, because the security flag and the behavioral indicator concern executable content. The third step is to confirm official support and contact channels independently of the live-chat widget. Finally, the security flag should be re-checked after the domain has aged, to see whether the detection is cleared or corroborated. Evidence:

• Homepage: the page describes buy/sell services through "listed third-party providers", and those providers' identities and terms are separate checks.
• Homepage: it claims "Device verified. Transaction review active", but these are mock-up labels, not evidence of working security functions.
• Domain provenance: the domain's very recent creation means no long operating history exists against which to compare the claims.

Summary Verdict

The assessment is an elevated-risk posture. Benign page design, clean behavioral network activity, and an absence of impersonation or phishing mechanics are outweighed by unresolved soft external threat detections, a malware-execution indicator, and a very new, unverified operator. The evidence does not establish that this site is an official CoolWallet property, and it does not support treating its downloadable software as safe.

Infrastructure Integrity

The site is fronted by the Vercel CDN/WAF, and both observed addresses are edge nodes in Amazon's network, so the origin server was not observable. This is a mitigating factor only, and it cannot offset the external reputation signals. About 60 abuse reports are attached to one of the edge addresses, 64.29.17.1, which Vercel, Inc operates as a Content Delivery Network address. That address is whitelisted, and the abuse-report confidence score is 0. The reports apply to a shared provider IP, so they are attributed to shared infrastructure and other tenants, not to this site. They have been discounted for that reason. The signal is shown here for transparency but does not count against the site.

Closing Assessment

Reading the page for information carries little exposure. Downloading or running the application, connecting a wallet, or transferring funds should wait until the manufacturer independently confirms that this domain and its installers are official and the security detections are resolved.

Signals weighed against the site

• AbuseIPDB: 60 reports on hosting IP 64.29.17.1 (Vercel, Inc, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.