Is doppler-finances.vercel.app a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website presents itself as Doppler Finance, a decentralized-finance product offering "XRPfi yield vaults" that invite visitors to deposit XRP and RLUSD and earn what it calls "institutional-grade yield" on the XRP Ledger. It runs from a free subdomain on a general-purpose application-hosting platform rather than a branded domain of its own. The apparent business model is custody or staking of crypto assets in return for advertised yield, which makes the visitor's funds the main point of exposure.

Scam/Impersonation Risk

Material contradictions are present. A major browser-safety service currently flags the site for social-engineering content, the deceptive-page category normally associated with phishing and fund-solicitation lures. A substantial number of independent security engines also classify it as malicious, and several leading security vendors are among them. Together these sources amount to a confirmed blacklist listing, and it is the decisive factor in this assessment. The title promises "institutional-grade yield" on deposited XRP and RLUSD. That is exactly the kind of unverifiable, return-led claim used to attract deposits, and nothing observed independently supports it. Behavioral testing showed none of the more aggressive wallet-attack mechanics: no wallet-drainer activity, no clipboard tampering, no hidden forms, and no cloaking. It did show all of the page's outbound data submissions going to destinations outside any recognized allow-list, with a large share of the page's external traffic going to third parties and repeated front-end errors. Many abuse reports are filed against the shared platform address the site resolves to. They are attributed to the hosting provider's multi-tenant infrastructure rather than to this site, so they are discounted and not counted against it. No conflicting legal identities were found, and brand impersonation is not confirmed. The site's deployment on a free shared subdomain, with a name that evokes an established finance brand, is nonetheless consistent with a low-effort, disposable footprint. Evidence:

• Homepage: the title advertises XRPfi yield vaults, deposits in XRP and RLUSD, and institutional-grade yield on the XRP Ledger. No independent substantiation was found.
• Browser-safety service: currently lists the site under the social-engineering threat category.
• Multi-engine malware and phishing scan: 15 engines flagged the site as malicious and 2 as suspicious, with Fortinet, Kaspersky and Sophos among the flagged vendors.
• Behavioral sandbox: 3 of 3 external data submissions went to non-allow-listed destinations, and 3 console errors were recorded. No drainer, clipboard-hijack or cloaking behavior was detected.

Regulatory Verification Notes

The site presents a financial product, yield-bearing vaults for digital assets, yet no regulatory registration could be tied to it through any third-party source, and no broker-reputation match exists. The operating entity could not be independently connected to any real-world company or individual, so identity remains unestablished. Because the site is a free subdomain, there is also no independent corporate domain from which a legal entity could be traced. For a service asking visitors to hand over crypto assets, this absence is material context, though it is a verification gap and not proof of wrongdoing in itself. The transport-layer facts are routine: a valid, domain-validated certificate from a mainstream issuer. Such a certificate encrypts traffic but says nothing about who operates the site or whether its claims are true. Evidence:

• Hosting: served from AS16509 (AMAZON-02, Amazon.com, Inc., US).
• TLS: certificate issued by WR1 (DV, domain validation only), valid to 2026-11-27.
• Third-party broker and regulatory datasets: no match found for the Doppler Finance name.

What to Verify Next

Before any further engagement, the only meaningful check is whether a legitimate Doppler Finance exists and where it officially operates. That means confirming the project's official domain, announcements and contract addresses through independent channels. Examples are the XRP Ledger ecosystem's own directories and the project's verified social accounts, reached by routes that do not start from this site. Any claim of licensing or custody arrangements should be confirmed with the relevant financial regulator's public register. The yield figures and "institutional-grade" description should be treated as unsubstantiated until an auditor or the registry supplies matching documentation. The official support and contact channels should also be confirmed offline. Evidence:

• Homepage: the yield-vault claims name no auditor, custodian or regulated counterparty that could be checked.
• Domain structure: the site sits on a shared platform subdomain, so the domain gives no ownership trail to follow.
• Threat listings: the current security flags should be rechecked directly with the issuing services for any delisting or remediation status.

Summary Verdict

The site's trust posture is critical. Confirmed external threat listings override every mitigating technical factor, and the operator's identity is unestablished. The site presents as a high-risk financial lure and not as an apparently legitimate service, and the evidence points to a clearly elevated danger of loss for anyone who interacts with it.

Infrastructure Integrity

The site is hosted on Amazon-operated cloud infrastructure and fronted by a CDN and WAF layer from the platform provider. All observed addresses are edge nodes, and no origin server was observable. This is a mitigating factor only. The platform is reputable and the certificate is valid, but shared hosting of this kind is open to any tenant, so it offers no assurance about this particular site. Edge-only visibility also means the underlying content can change quickly and without notice.

Closing Assessment

The site should not be used for any login, wallet connection, deposit or other financial interaction, and no credentials or asset approvals should be given to it. Anyone who has already interacted with it should revoke any wallet permissions granted and watch the affected accounts and addresses for unauthorized activity.

Signals weighed against the site

• AbuseIPDB: 107 reports on hosting IP 216.198.79.195 (Vercel, Inc, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.