Verdict
Several risk patterns were present. Do not send money or personal details until you have verified this business another way.
node-node-8898-fwaqbwzmv-dappp.vercel.app is low-trust and potentially risky.
Evidence status and limitations
Evidence completeness: Not recorded
- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.
At a glance
The checks that decide most of this verdict.
| Malware engines | 2 flagged itVirusTotal | Risk |
|---|---|---|
| Google Safe Browsing | Not listedGoogle | Clear |
| Abuse reports on the host | 0% confidenceAbuseIPDB, 82 reports; shared hosting inflates reports | Clear |
| Domain age | Not availableNo registration record was returned | Noted |
| Web archive | Never archivedNo public history of this site | Watch |
| Certificate | Encrypted connectionIssued by WR1 | Noted |
The page as captured
Key findings
- Automated classification: Sensitive Interaction Risk.
- At least one reputation service TrustSniffer consulted had flagged this domain at assessment time.
Full analysis
Overview
This is a single-page website on an auto-generated subdomain of a public application-hosting platform. Its page title presents it as the Chrome Web Store listing for the Rabby Wallet cryptocurrency browser extension. The homepage reproduces the look of a browser-extension download page. Its apparent purpose is to steer visitors toward installing or interacting with a crypto wallet product. The evidence does not tie it to the wallet's official publisher.
Scam/Impersonation Risk
Contradictory signals are present, and the posture is cautionary. Two independent threat-intelligence engines classify the site as malicious and a third flags it as suspicious. An external blacklist also lists it, so the site is blacklisted on reputational grounds. The homepage title borrows a well-known wallet brand and the Chrome Web Store name. It is served from a machine-generated hosting subdomain rather than the official extension marketplace or the wallet publisher's own domain. That combination matches the pattern of counterfeit wallet-download pages, which are used to harvest seed phrases, push trojanised extensions, or trigger malicious wallet-connection prompts. The sandbox runs did not show wallet-connection requests, clipboard manipulation, hidden or externally posting forms, or cloaking. This is a favourable observation about the captured behaviour, but it does not offset the blacklist and detection signals. Page content can change quickly on this type of hosting, so clean behaviour on three runs does not guarantee future behaviour. A separate abuse-report history is attached to a shared network address of the hosting provider. It is attributed to shared infrastructure and discounted, so it is not counted against this site.
- Homepage: the page title presents the site as the Chrome Web Store listing for the Rabby Wallet extension, while the site is hosted on a generic generated subdomain.
- Reputation checks: two engines rate the site malicious and one rates it suspicious, and an external blacklist lists it.
- Behavioural sandbox: three successful homepage runs showed no outbound requests to third parties, no wallet-provider calls, no clipboard writes and no hidden forms.
- Abuse history: 82 reports on a shared provider address, rated zero-confidence and discounted as shared infrastructure.
Regulatory Verification Notes
No legal-entity, licensing or registration information could be tied to the site. The captured page does not connect it to a named operator, a publisher account or a regulated financial entity. No independent source links the site to the official wallet publisher. Ownership is opaque, and this is a governance limitation rather than an identity contradiction, because no conflicting legal names were found. No third-party broker or regulatory-database record matches the site, so there is no reputational signal from that source in either direction. Because the site presents itself as software distribution for a financial-access tool, the lack of any verifiable publisher identity is material to the overall caution.
- Homepage: no named operator, legal entity, licence or registration reference is tied to the wallet-extension presentation.
- Hosting: served from AS16509 (AMAZON-02 - Amazon.com, Inc., US) under the hosting platform's shared subdomain space, which gives no operator-specific identity.
- Transport encryption: TLS certificate issued by WR1 (DV), valid to 2026-11-27. Domain-validated certificates confirm only control of the hostname, not the identity of an operator.
What to Verify Next
Anyone wanting the Rabby Wallet extension should obtain it only by navigating directly to the official marketplace or to the publisher's own website, reached independently rather than through this page. The publisher identity, developer account and listed website on the official extension page should be compared against the official channels. Any link, instruction or prompt originating from this site should be treated as untrusted, and no recovery phrase or private key should ever be entered. If the site has been received by message or advertisement, its source should be reported to the platform or messenger that delivered it. Organisations should consider reporting the site to the hosting provider's abuse channel and to the wallet publisher's security contact. Because this page lists no verifiable corporate registration, any claim of authorisation from the publisher should be confirmed with the publisher directly.
- Homepage: the wallet-brand title and marketplace framing are the claims that need independent confirmation.
- Reputation checks: the malicious and suspicious detections and the external blacklist listing support routing reports to the hosting provider.
- Sandbox behaviour: no wallet-connect prompts were observed in the captured runs, so any later wallet or seed-phrase request would indicate a change in behaviour.
Summary Verdict
The site carries an elevated risk posture. Confirmed blacklist and detection signals combine with a brand-mimicking presentation and an unverifiable operator, and the benign captured behaviour is insufficient to lift that assessment. The evidence is consistent with a possible counterfeit wallet-distribution page, although no phishing or impersonation has been conclusively established. It is not suitable for sensitive interactions.
Infrastructure Integrity
The site is served from AS16509 (Amazon) behind the Vercel edge network. All eight observed addresses are edge nodes, and the origin server was not observable. Protective infrastructure of this kind and a valid transport-encryption certificate are mitigating factors only. They show that the site is professionally hosted, not that its content or operator is legitimate. The edge-only visibility also means that independent hosting verification is not possible and content could be swapped quickly. The infrastructure does not offset the reputational risk.
Closing Assessment
The site should be limited to passive, read-only viewing at most. No login, credentials, wallet connection, seed phrase, download or financial transaction should be performed through it. Wallet software should be obtained solely from the publisher's official channels.
Written analysis generated 2026-10-25 by the TrustSniffer Analysis Engine from the evidence in this report.
What the analysis found
2 findings contributed to this verdict, raised by external reputation, registration and ownership.
01 External reputation
- Several malware engines flagged this domain.External reputation
rule:EXT_BLACKLIST_HIGH
02 Registration and ownership
- The public registration record for this domain is incomplete.Registration and ownership
rule:KF_WHOIS_INCOMPLETE
Signals weighed against the site
- AbuseIPDB: 82 reports on hosting IP 64.29.17.131 (Vercel, Inc, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.
Identity verification
| Status | UNKNOWN |
|---|---|
| Identity score | 50/100 |
| Identity verification confidence | 30% |
- AI page analysis unavailable (page captured; identity not AI-verified)
Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence.
What TrustSniffer observed
First-party facts recorded during the assessment of node-node-8898-fwaqbwzmv-dappp.vercel.app.
- The request stayed on node-node-8898-fwaqbwzmv-dappp.vercel.app. It was not redirected to another domain. Clear
- It is hosted on AMAZON-02, from a server in US. Noted
Domain intelligence
| Registrar | Not available |
|---|---|
| Hosting | AMAZON-02 - Amazon.com, Inc., US |
| Country | US |
| Server IP | 64.29.17.131 |
| Name servers | Not available |
| CDN / edge network | Detected |
| Resolved IP addresses | 8 |
| Edge IP addresses | 8 |
| Likely origin IP addresses | 0 |
| SSL issuer | WR1 |
| SSL expiry | 2026-11-27 |
| Domain age | Not available (no registration date was returned) |
| Domain expiry | Not available |
| Archive first seen | Not available |
| Archive snapshots | 0 |
| Reputation | VirusTotal: 2 flagged | AbuseIPDB: 0% confidence, 82 reports | Google Safe Browsing: 0 matches |
About this assessment
A trust score summarises the evidence TrustSniffer could collect about node-node-8898-fwaqbwzmv-dappp.vercel.app at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.
TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.