Is kokomojinft.web.app safe? TrustSniffer's low-trust assessment: 38/100

Overview

This website presents a single landing page titled "Kokomoji — 3,333 faces, assembled on-chain." It markets what appears to be a fixed-supply collection of digital face artworks, most likely an NFT-style project. It is served from a shared platform subdomain rather than a dedicated branded domain. Its apparent purpose is to promote and possibly sell or mint the collection.

Scam/Impersonation Risk

Elevated reputational risk exists, and it rests on one confirmed contradiction: the domain is on an external blacklist. Independent reputation sources return a malicious detection and a separate suspicious detection against the site. This is the decisive signal in the assessment. No brand impersonation, no conflicting legal identities, and no phishing-form behaviour were observed. The homepage capture showed no wallet-connection prompts, no clipboard manipulation, no hidden or externally posting credential forms, and no cloaking after interaction. The blacklist hit nonetheless outweighs this clean behaviour, because a page that is clean when captured can be changed quickly. Four abuse reports exist against one of the site's delivery addresses. That address belongs to shared content-delivery infrastructure serving many unrelated sites, so those reports cannot be attributed to this site alone. They are a supporting reputational signal and not independent proof. Because the collection is built around on-chain assets, any prompt to connect a wallet or sign a transaction should be treated as a high-consequence action. Evidence:

• Homepage: the title advertises "3,333 faces, assembled on-chain," a fixed-supply digital collection with no further verifiable product detail captured.
• External reputation sources: one malicious and one suspicious detection against the domain, which constitutes the confirmed blacklist.
• Network behaviour on the homepage: nine external fetch and post requests, none to non-whitelisted destinations, with six browser console errors.
• Shared delivery address: four abuse reports, attributed to shared infrastructure and not discounted.

Regulatory Verification Notes

The captured page gave no analysable legal or identity content. No operator name, licence, or registration reference could be assessed, and the real-world operator is not independently connected to any known brand or person. Legitimacy therefore cannot be established from the site itself. No third-party broker or regulatory-database match exists for this site, which means neither regulatory standing nor a regulatory warning is established. For a site that invites participation in a token or collectible sale, the absence of any assessable operator disclosure leaves nothing to offset the reputational findings above. The transport layer is technically sound but carries little weight on its own. Domain-validated certificates confirm control of a hostname only and say nothing about who operates the site. Evidence:

• The site is served from AS54113 (Fastly, Inc., US), and the certificate is domain-validated only.
• TLS certificate issued by WR4 (DV), valid to 2026-12-22.
• Homepage: no assessable operator, company, or licensing information was captured.
• No regulatory or broker-database match was found for the site.

What to Verify Next

The domain's blacklist status should be re-checked directly with the listing sources, and any delisting or remediation notice reviewed. The project's identity should be confirmed through channels independent of this site, such as an established marketplace listing, verified social accounts, or a published smart-contract address. That contract address should be checked on a public block explorer for deployment date, supply (the claimed 3,333 pieces), and ownership permissions. The official support or contact channels should be confirmed offline before any interaction. Any wallet-connection or signing request should be inspected closely. Evidence:

• Homepage: the supply figure of 3,333 can be checked against on-chain contract data.
• External reputation sources: the current listing status should be re-examined before any engagement.
• The shared subdomain gives no independent proof of project ownership, so confirmation must come from outside the site.

Summary Verdict

The available evidence supports a clearly cautionary, high-risk posture. A confirmed external blacklist, together with no verifiable operator identity, outweighs the technically orderly behaviour observed. The site cannot be treated as trustworthy for any transactional purpose.

Infrastructure Integrity

The site is delivered through Fastly's CDN and WAF (AS54113, US). Both observed addresses are edge nodes, and the origin server was not observable. The edge-only view prevents independent hosting verification and can mask rapid content swaps. Protective infrastructure is a mitigating factor only. It cannot offset the reputational risk, and it does not indicate that the site is legitimate.

Closing Assessment

Interaction should be limited to passive viewing. Account login, credential entry, wallet connection, token or NFT purchases, and any payment should be avoided until the blacklist status is resolved and the project's identity is independently confirmed.

Signals weighed against the site

• AbuseIPDB: 4 reports on hosting IP 2620:0:890::100 (Google LLC, Content Delivery Network), 3% confidence. The reports are attributed to shared infrastructure, not specifically to this website.