Verdict
This assessment found strong scam indicators. Do not pay, sign in, or share personal details with this site.
realopenseaio.vercel.app shows high-risk / scam indicators.
Evidence status and limitations
Evidence completeness: Not recorded
- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.
At a glance
The checks that decide most of this verdict.
| Malware engines | 13 flagged itVirusTotal | Risk |
|---|---|---|
| Google Safe Browsing | Listed as unsafeGoogle | Risk |
| Abuse reports on the host | 0% confidenceAbuseIPDB, 108 reports; shared hosting inflates reports | Clear |
| Domain age | Not availableNo registration record was returned | Noted |
| Certificate | Encrypted connectionIssued by WR1 | Noted |
| Hosted by | AMAZON-02Server in US | Noted |
The page as captured
Key findings
- Automated classification: Sensitive Interaction Risk.
- At least one reputation service TrustSniffer consulted had flagged this domain at assessment time.
Full analysis
Security Alert
Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.
This is a single-page website served from a free subdomain on a shared application-hosting platform. Its hostname embeds the name of a well-known NFT marketplace, prefixed with "real" and suffixed with "io". The captured homepage carries only a short block of text, and no product, pricing, or service detail could be extracted from it. Its apparent purpose is to pose as, or trade on, an NFT-marketplace brand and draw visitors into wallet or account interactions.
Scam/Impersonation Risk
Multiple independent external reputation sources converge on a confirmed blacklist condition. A major browser safe-browsing service flags the site under its social-engineering category, which covers phishing and deceptive-page behavior. A double-digit number of security engines, including several top-tier vendors, independently classify the domain as malicious. This is the decisive finding and is not offset by any benign technical attribute. The hostname structure compounds the concern. It places a recognised marketplace brand string inside a free, disposable subdomain on a general-purpose hosting platform rather than on a domain the brand would control. This is a common pattern in credential and wallet-phishing campaigns. No conflicting legal identities were observed, and the evidence does not independently prove brand impersonation. Contradictory signals are nonetheless present and severe. A large volume of abuse reports exists against one of the platform's shared edge addresses. These were attributed to shared provider infrastructure rather than to this site, and they carry no weight in this assessment. Automated sandbox sessions observed no outbound third-party requests, no wallet-drainer behavior, no clipboard manipulation, and no hidden or externally posting password forms. Because such pages can be rotated or swapped quickly, this does not negate the external detections. It means only that nothing malicious was triggered during those particular runs.
- Homepage: flagged by a major browser safe-browsing service as social engineering.
- Homepage: widely detected as malicious by a large number of independent security engines, including several top-tier vendors.
- Hostname: a marketplace brand string sits inside a free shared-platform subdomain, not a brand-controlled domain.
- Sandbox sessions on the homepage: three successful runs with no external requests, wallet-drainer activity, clipboard hijacking, or externally posting forms.
Regulatory Verification Notes
The captured homepage contains very little legal or identity content. It names no operating company and no licensing or registration status, and it gives no recognisable governance information. The operator's real-world identity is therefore not independently established. The site offers no basis for treating it as an authorised or affiliated presence of the marketplace brand it evokes. A third-party broker-reputation lookup returned no match. That is neutral context and neither supports nor undermines the site. These gaps are secondary to the reputation findings above and are noted only for completeness. The site sits behind a valid TLS certificate, but a DV certificate confirms only domain control and encrypted transport. It says nothing about who runs the site.
- Homepage: very brief text with no company name, licence, or registration reference.
- Transport layer: TLS certificate issued by WR1 (DV), valid to 2026-11-27 with 31 days remaining.
- Hosting: served from AS16509 (AMAZON-02 - Amazon.com, Inc., US), registry ARIN.
What to Verify Next
The brand association should be tested directly. The marketplace's own official channels, reached by typing its known address or using a bookmark saved earlier, should be checked for any statement on this hostname. Any link that led to this page, such as a message, advertisement, or social post, should be treated as the likely delivery route. It should be reported to the platform where it appeared. Wallet connections, signature requests, seed phrases, or credentials should not be entered on this page at any point during that checking. The hosting platform's abuse process and the safe-browsing service's reporting form can be used to flag the page if it has not already been taken down. Its listing status should be rechecked later, since removal would be a meaningful change.
- Homepage: the extracted text contains no verifiable operator or affiliation statement to check against.
- Hostname: the shared-platform subdomain structure gives no ownership trail that could substitute for official-channel confirmation.
Summary Verdict
The site presents an elevated, high-risk posture. The decisive factor is convergent external detection of deceptive behavior, which outweighs every benign technical attribute. Its legitimacy and operator identity are unestablished, and the available evidence points toward a deceptive page rather than a genuine marketplace.
Infrastructure Integrity
The site is delivered through a trusted CDN/WAF provider. All observed addresses are edge servers, and no origin server was observable, so the real hosting location cannot be independently confirmed. Protective edge infrastructure and a valid certificate mitigate technical exposure only. They are shared by legitimate and abusive sites alike, so they carry no weight as evidence of legitimacy and cannot offset the reputation findings.
Closing Assessment
The page should be treated as unsafe for any sensitive action. This covers logging in, connecting a wallet, signing transactions, entering credentials, and making any payment. Passive viewing is the only reasonable use. Anyone who has already interacted with it should move assets to a fresh wallet, revoke token approvals, and change any reused passwords.
Written analysis generated 2026-10-27 by the TrustSniffer Analysis Engine from the evidence in this report.
What the analysis found
3 findings contributed to this verdict, raised by governance, external reputation, registration and ownership.
01 Governance
- A threat feed lists this domain as malicious, and that caps the score whatever the other checks found.Governance
rule:GOV_CRITICAL_BLACKLIST
02 External reputation
- An external threat feed lists this domain: either Google Safe Browsing marked it malicious, or a significant number of malware engines flagged it.External reputation
rule:EXT_BLACKLIST_CRITICAL
03 Registration and ownership
- The public registration record for this domain is incomplete.Registration and ownership
rule:KF_WHOIS_INCOMPLETE
Signals weighed against the site
- AbuseIPDB: 108 reports on hosting IP 216.198.79.195 (Vercel, Inc, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.
Identity verification
| Status | UNKNOWN |
|---|---|
| Identity score | 50/100 |
| Identity verification confidence | 30% |
- AI page analysis unavailable (page captured; identity not AI-verified)
Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence.
What TrustSniffer observed
First-party facts recorded during the assessment of realopenseaio.vercel.app.
- The request stayed on realopenseaio.vercel.app. It was not redirected to another domain. Clear
- It is hosted on AMAZON-02, from a server in US. Noted
Domain intelligence
| Registrar | Not available |
|---|---|
| Hosting | AMAZON-02 - Amazon.com, Inc., US |
| Country | US |
| Server IP | 216.198.79.195 |
| Name servers | Not available |
| CDN / edge network | Detected |
| Resolved IP addresses | 8 |
| Edge IP addresses | 8 |
| Likely origin IP addresses | 0 |
| SSL issuer | WR1 |
| SSL expiry | 2026-11-27 |
| Domain age | Not available (no registration date was returned) |
| Domain expiry | Not available |
| Archive first seen | Not available |
| Archive snapshots | Not counted (archive lookup incomplete) |
| Reputation | VirusTotal: 13 flagged | AbuseIPDB: 0% confidence, 108 reports | Google Safe Browsing: 1 match |
About this assessment
A trust score summarises the evidence TrustSniffer could collect about realopenseaio.vercel.app at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.
TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.