Is eth-chat-sigma.vercel.app a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Google, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This is a Vercel-hosted web application on a subdomain whose name suggests an Ethereum-themed chat service. At analysis time its homepage returned only a "not found" error page with almost no readable text, so it presented no visible product, company, or service. Its apparent purpose could not be established from the captured content. The domain is recently created, and available evidence ties it to external security detections rather than to any legitimate, identifiable business.

Scam/Impersonation Risk

Contradictory signals are present and substantial. The site is confirmed blacklisted. A major browser safe-browsing service flags it for social engineering, the classification used for phishing and deceptive-credential pages. Many independent security engines also rate it malicious, including several top-tier vendors. These detections independently corroborate one another and are the decisive factor in this assessment. Behavioral testing adds to the concern: after simulated user interaction, the page's content and appearance changed materially from what was first served. This is a strong cloaking pattern, in which a page shows one thing to a scanner or first-time visitor and another once engaged. It is a technique commonly used to hide credential-harvesting or wallet-related lures. The page also made a very heavy volume of outbound requests, including a dozen external data submissions, with nearly all page activity directed off-site. All of those destinations were recognised, non-suspicious services, and no wallet-drainer, hidden-form, or external password-form behavior was observed. A clipboard write was detected, but no clipboard hijacking was confirmed. The roughly ninety abuse reports on the network address were attributed to a shared content-delivery address used by many unrelated customers. They were therefore discounted and are not treated as evidence against this site. No conflicting legal identities were found, and brand impersonation is not confirmed. The risk rests on the confirmed threat listings and the cloaking behavior. Evidence:

• Homepage: returned a "not found" error with minimal text, yet content shifted noticeably after interaction (strong cloaking, post-interaction).
• Reputation: flagged by the browser safe-browsing service for social engineering. 15 engines rated it malicious and 1 suspicious, including 4 tier-1 vendors.
• Behavioral testing: 70 external XHR/fetch calls and 12 external POSTs across 3 successful runs, all to whitelisted destinations.
• Provenance: domain registered in 2026 (~0.36 years old), with 1 archive snapshot (first and last seen 2026-06-16, 1 year tracked).

Regulatory Verification Notes

The captured page contains no terms, privacy policy, about page, company name, registration number, or license, so no regulatory or corporate status can be assessed from the site. Operator identity is not verified, and the site shows signs of ownership and governance opacity. Because only an error page was captured, this is a lack of verifiable disclosure, not evidence of any specific licensing violation. No third-party broker or regulator-style reputation entry matched this site. Hosting is on a mainstream cloud network with a valid but entry-level certificate, which establishes only basic transport security, not identity or legitimacy. Evidence:

• Homepage: no legal entity, license, or registration disclosure in the captured content.
• Hosting: served from AS16509 (AMAZON-02, Amazon.com, Inc., US).
• Transport encryption: TLS certificate issued by WR1, domain-validated (DV) only, valid to 2026-11-27 (32 days remaining).

What to Verify Next

Credentials, wallet connections, and payments should not be attempted until the site's operator is independently identified and the security listings are formally cleared. Any party who sent a link to this site should be contacted through a separate, independently known channel to confirm the link was legitimately issued. If the site is claimed to belong to a known organization, its official domain should be confirmed from that organization's own published materials, and the claim should be compared against this address. Security teams should also confirm whether the listings are later removed and whether the site stably serves consistent content. Evidence:

• Homepage: the captured page presents no identifiable operator, so any claimed affiliation cannot be tested on-site.
• Reputation: the safe-browsing and multi-engine detections were active at analysis time.
• Behavior: the content change after interaction needs re-testing to determine whether it persists.

Summary Verdict

The overall posture is high-risk. Confirmed multi-source threat detections, combined with deceptive-behavior indicators and an unverified operator on a very young domain, outweigh the basic technical hygiene the site shows. The evidence does not support treating this site as legitimate or safe for sensitive interaction.

Infrastructure Integrity

The site is delivered through a trusted cloud and content-delivery platform on a major US hosting network. All observed addresses are shared edge servers, and the true origin server was not observable. This provides baseline availability and transport protection and is a mitigating factor only. Edge-only visibility prevents independent hosting verification and can mask rapid content swaps, so it cannot offset the reputation risk established above.

Closing Assessment

Do not log in, connect a wallet, sign transactions, enter personal data, or make any payment on this site. Do not download or run anything it offers. At most, treat it as a read-only item for security review, and report it to the appropriate abuse channel if it was received through an unsolicited message.

Signals weighed against the site

• AbuseIPDB: 91 reports on hosting IP 64.29.17.195 (Vercel, Inc, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.