Is rima-rouge.vercel.app a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a single-page application hosted on a free-tier subdomain of a general-purpose developer hosting platform. Its page title presents it as the "Trezor Suite App (Official)", described as a desktop and web crypto-management tool for a hardware-wallet brand. A visitor is shown a polished crypto-wallet management interface with roughly nine thousand characters of rendered text. Its apparent purpose is to draw cryptocurrency holders into a hardware-wallet management workflow, a category where operators are often impersonated to harvest wallet credentials, recovery phrases, or transaction approvals.

Scam/Impersonation Risk

This is the dominant risk dimension, and the evidence converges on it. A confirmed blacklist condition applies: a large cluster of independent security engines currently flags the domain as malicious, including several top-tier endpoint-security vendors, and this independently triggers a hard ceiling on the assessment. The behavioral sandbox adds a second, separate line of evidence. After simulated user interaction, the page showed strong cloaking behavior: its rendered content and structure changed substantially, with thousands of DOM mutations and clear semantic and visual divergence from the initial view. A page that presents one face on load and a materially different one after interaction is a recognized evasion pattern, used to defeat automated scanners and reviewers. It is especially concerning here because the site claims to be an official product of a well-known security brand while living on a shared, generic hosting subdomain rather than on any dedicated domain. The sandbox did not observe wallet-connection prompts, clipboard tampering, hidden forms, or outbound data posts to third parties. That limits what has been directly demonstrated, but it does not offset the blacklist condition or the cloaking, and the sandbox may not have triggered the behavior that matters most. No conflicting legal entities appear on the site, so no identity contradiction exists. The risk rests on the blacklist condition, the evasive page behavior, and the unsupported "official" brand claim. Evidence:

• Homepage: the page title claims to be the official suite application of a hardware-wallet brand, while the site is served from a free shared-platform subdomain.
• Homepage behavior: strong post-interaction cloaking, with 2,310 DOM mutations in a single run and 12 console errors across three successful sandbox runs.
• Reputation: 17 security engines rated the domain malicious and one suspicious, including three tier-1 endpoint-security vendors.
• Sandbox network activity: zero external requests or posts observed, and no wallet-provider or drainer behavior detected.

Regulatory Verification Notes

The site presents no identifiable operator, legal entity, registration number, or licensing information on the pages captured, so its on-page disclosure state remains unclear. Nothing links the site to the brand it claims to represent, and no third-party regulatory registration was matched. No broker-reputation entry exists for it either. Ownership and governance opacity are therefore present as administrative conditions. Because they sit alongside the confirmed reputation findings, they cannot be treated as benign here. They remove any basis for crediting the "official" claim, and the site's identity cannot be treated as established. Evidence:

• Homepage: the "official" brand claim is unaccompanied by any named operator, company details, or licensing reference.
• Transport encryption: a domain-validated certificate issued by WR1, valid to 2026-11-27, which confirms encryption only and says nothing about the operator's identity.
• Hosting: served from AS16509 (AMAZON-02 - Amazon.com, Inc., US) through shared-platform infrastructure.

What to Verify Next

Any wish to use this application should be settled by reaching the vendor's software through its own official channels, with the address typed manually or taken from the physical product packaging or documentation, rather than through this site or any link leading to it. Anyone who has already entered a recovery phrase, PIN, or wallet credential here should treat the wallet as exposed. Such a user should move assets to a freshly generated wallet from a trusted device and review recent transaction approvals. Security teams may wish to report the page to the hosting platform and to the brand's official abuse channel for takedown review. Evidence:

• Homepage: the interface presents a crypto-management workflow, which implies exposure to recovery phrases and transaction signing.
• Reputation findings: the current malicious detections indicate that any credential entered on this site is at risk.
• Hosting: the shared-platform subdomain means abuse reports can be filed with the platform operator.

Summary Verdict

The site is rated as critical risk. Converging evidence of confirmed external blacklisting, evasive post-interaction page behavior, and an unsupported claim to be an official product of an established security brand defines its posture. Supportive technical signals are present, but they are cosmetic and cannot offset the reputation and behavior findings. The operator's real-world identity is not established, and the evidence is most consistent with a brand-impersonation lookalike.

Infrastructure Integrity

The site resolves to Amazon-hosted addresses behind a shared CDN/WAF platform, with the origin server not observable, so hosting cannot be independently verified. This also means content can be swapped quickly without a visible change in address, which is consistent with the cloaking observed. A large number of abuse reports (87) exists against one of the shared edge addresses. Those reports relate to the platform's shared infrastructure rather than to this site specifically, so they are treated as discounted context. Protective infrastructure is a mitigating factor only and does not offset the reputation risk.

Closing Assessment

The site should not be used for login, entering wallet credentials or recovery phrases, connecting a wallet, or any financial interaction. Passive viewing in an isolated environment is the only proportionate use, and nothing should be downloaded from it. Organizations should consider blocking the domain and alerting users who may have received links to it.

Signals weighed against the site

• AbuseIPDB: 87 reports on hosting IP 216.198.79.3 (Vercel, Inc, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.