Is openocean-fi.vercel.app a scam? TrustSniffer's high-risk assessment: 21/100

Overview

The website is a single-page, token-themed landing page titled "$OOE — Claim Rewards". It is hosted on a free subdomain of a public application-hosting platform, and its name styles it after a decentralized-finance brand. The captured page is short and carries a reward-claim call to action. Its apparent purpose is to draw visitors into claiming a token reward, a pattern commonly associated with wallet-linked or credential-linked engagement funnels. No operator, product documentation, or corporate identity is presented in the captured content.

Scam/Impersonation Risk

This assessment carries elevated risk. The site is blacklisted by external threat-intelligence sources. Two independent engines classify it as malicious and one more flags it as suspicious. This corroborated reputation hit is the decisive factor, and the site's valid encryption and mainstream hosting cannot offset it. The "claim rewards" framing, the token ticker in the page title, and a hostname that imitates an established DeFi aggregator's name on a throwaway subdomain match the profile of reward-claim lures. Real-world identity has not been independently connected to any genuine brand, so any apparent affiliation with a known project should be treated as unproven. In the sandbox the page loaded stably across all runs. Roughly three-fifths of its network requests went to external destinations, including a heavy volume of outbound POST traffic and several destinations outside the commonly recognized set. That is unusual for a one-screen landing page, and the payloads could not be attributed to a legitimate function. No wallet-connection prompts, clipboard tampering, hidden forms, cloaking, or credential forms posting off-site were observed. This reduces the likelihood of an automated drainer on first load but does not clear the site. Abuse reports against the shared edge address have been discounted. They apply to a platform IP used by many unrelated tenants and are not attributed to this site. No conflicting legal identities and no confirmed phishing-page classification were recorded. Evidence:

• Homepage: external threat-intelligence sources report 2 malicious and 1 suspicious detection, and the site is externally blacklisted.
• Homepage: the page title reads "$OOE — Claim Rewards", a reward-claim lure framing with no explanatory product content.
• Sandbox behaviour (3 of 3 runs): 36 external requests, including 21 external XHR/fetch calls and 15 external POSTs, 3 to non-whitelisted destinations.
• Shared hosting IP: 91 abuse reports, attributed to shared infrastructure and discounted.

Regulatory Verification Notes

The captured homepage discloses no licensing, registration number, legal entity, or named operator, and on-page disclosure is unclear. For a site inviting reward claims, this means no regulated-entity status can be inferred. There is no third-party broker or regulator record matching the site, so no reputational context exists to counterbalance the threat detections. The valid, publicly trusted certificate establishes only transport encryption. It says nothing about who runs the site. Legitimacy cannot be described as established, and the operator's identity remains unverified. Evidence:

• Homepage: no company name, licence, jurisdiction, or terms of service in the captured content.
• Transport security: TLS certificate issued by WR1 (DV, domain-validated only), valid to 2026-11-27.
• Hosting: served from AS16509 (AMAZON-02 - Amazon.com, Inc., US).
• No matching broker-reputation record was found.

What to Verify Next

Before any engagement, the claim of association with any known DeFi project should be tested against that project's official channels, reached independently of this site. Any token or contract named on the page should be checked on a public block explorer for issuer and deployment history. Official support and contact channels should be confirmed through an independent route. The site should not be used to connect a wallet, sign a message, or submit credentials while the threat detections stand. Evidence:

• Homepage: reward-claim call to action with no linked documentation or contract reference.
• Sandbox behaviour: outbound POST traffic to external destinations, recipients unidentified.
• Reputation: active detections remain outstanding.

Summary Verdict

The overall posture is high-risk. Corroborated external threat detections, together with the lure-style presentation and unverified operator identity, outweigh the technically sound but non-probative encryption and hosting. The evidence supports treating this as a potentially malicious reward-claim site, not a legitimate service.

Infrastructure Integrity

The site is delivered through the Vercel platform on Amazon-hosted edge servers, and all observed addresses are shared edge nodes in the United States. The true origin is not observable. This is a mitigating factor only, because shared platform hosting is trivially available to any actor and does not separate a benign tenant from a malicious one. Edge-only visibility also prevents independent hosting verification and can mask rapid content swaps.

Closing Assessment

Interaction should be limited to passive viewing at most. Wallet connections, signatures, logins, credential entry, and any financial action should be avoided, and anyone who has already interacted with the page should review wallet approvals and rotate any exposed credentials.

Signals weighed against the site

• AbuseIPDB: 91 reports on hosting IP 64.29.17.195 (Vercel, Inc, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.