Is iota--o.web.app a scam? TrustSniffer's high-risk assessment: 23/100

Overview

This website is a single-page property published on a shared web-app hosting subdomain. Its homepage is titled "IOTA | Built to Make a Difference", and it presents itself under the IOTA name. The page text is substantial and served normally. The evidence does not establish a specific product, service or business model, so its apparent purpose is brand-led promotion under that name. Nothing independently ties it to the real-world organisation or project behind that name.

Scam/Impersonation Risk

Contradictory signals are present, and this is the decisive part of the assessment. Several threat-detection sources flag the domain as malicious or suspicious, and these detections amount to a confirmed blacklist listing. Independent of that, the analysis recorded a prior phishing-association indicator for the domain, which activated impersonation safeguards. The domain is a brand-styled name on a free, shared hosting namespace, with a doubled hyphen inside the name. That pattern is common among look-alike pages that borrow a well-known project's name, and the evidence does not link the site to the genuine brand. Infrastructure-level abuse reports exist but attach to a shared provider address on the content-delivery network, so they do not on their own implicate this site. They add nothing beyond the direct detections. No conflicting legal entities were found across identity pages. Behavioural testing showed no wallet-connection prompts, clipboard tampering, hidden forms, credential posts to external hosts or content cloaking. That limits what was observed, but it does not offset the external detections. The page also rewrote a large amount of its own content after interaction, which fits a dynamic single-page application but gives limited reassurance given the listing. Evidence:

• Homepage: external threat-detection sources return 2 malicious and 1 suspicious verdicts, against 57 harmless and 33 undetected.
• Domain history: a prior phishing-association indicator is recorded and triggered impersonation safeguards. No confirmed phishing campaign is documented here.
• Homepage behaviour: 3 of 3 test sessions succeeded with no wallet-connect, clipboard-write, hidden-form or external password-form activity. Third-party requests were 3 background calls and 3 form posts, all to allow-listed destinations.
• Homepage behaviour: roughly 2,775 DOM mutations after interaction, indicating heavy client-side rewriting.

Regulatory Verification Notes

The evidence does not independently connect the site to a real-world operator, brand or regulated entity. No third-party regulatory or broker record matches the domain, and no licensing or registration status could be confirmed. A missing licence on its own is a verification gap, not proof of fraud here. The decisive concern is the confirmed threat listing, not any disclosure shortfall. The homepage was captured successfully, but its identity and governance disclosures remain unclear. Ownership and governance transparency are limited, so the site's claim to the IOTA name cannot be treated as established. Evidence:

• Homepage: the title presents the IOTA brand, but no operator, registration or licence detail was independently corroborated.
• Hosting: served from AS54113 (Fastly, Inc., US) in the US ARIN region.
• Transport encryption: TLS certificate issued by WR4 (domain-validated only), valid to 2026-12-22. This confirms an encrypted connection and says nothing about who runs the site.
• Third-party broker intelligence: no matching record.

What to Verify Next

Before any engagement, the site's association with the IOTA name should be tested against the project's officially published domain, reached through an independent route such as a previously known, bookmarked source rather than any link on this site. Any claim of affiliation, token distribution or account service should be confirmed through the project's official channels. Official support and contact channels should likewise be confirmed independently. The domain's detections should be re-checked with the relevant threat-intelligence sources, because a listing on a shared hosting namespace can reflect either deliberate abuse or a clean-up that is still pending. Evidence:

• Homepage: branded IOTA content on a free shared-hosting subdomain, not on a dedicated, brand-controlled domain.
• Reputation: current malicious and suspicious detections remain active against this exact hostname.
• Identity: no independent confirmation links the site to a real-world operator.

Summary Verdict

The overall posture is high risk. Confirmed external threat detections, together with impersonation safeguards triggered by a prior phishing association and an unverified brand claim, outweigh the technically clean transport and behaviour results. The evidence supports caution proportionate to a site with a confirmed listing, not a presumption of legitimacy.

Infrastructure Integrity

The site is delivered through the Fastly content-delivery network, and every observed address is an edge node. The origin server could not be observed, so hosting cannot be verified independently behind the edge, and content could be swapped quickly without any visible change in infrastructure. This is a mitigating factor only. The edge network is mainstream, and the certificate is valid and chains to a recognised issuer, but neither can offset the reputation risk.

Closing Assessment

Treat the site as read-only at most. Do not log in, submit credentials, connect a wallet, or make any financial transaction or payment through it. Use only the project's officially published channels for any real interaction.

Signals weighed against the site

• AbuseIPDB: 4 reports on hosting IP 2620:0:890::100 (Google LLC, Content Delivery Network), 3% confidence. The reports are attributed to shared infrastructure, not specifically to this website.