--- title: "Is rima-rouge.vercel.app a Scam? Trust Score 0/100" source: TrustSniffer type: Website trust & fraud report subject: "rima-rouge.vercel.app" verdict: "Critical Risk" title: "Is rima-rouge.vercel.app a Scam? Risk Report, Score 0/100" trust_score: 0 classification_confidence: 55 canonical_url: https://trustsniffer.com/report/rima-rouge.vercel.app assessed: 2026-10-26 --- # Is rima-rouge.vercel.app a scam? TrustSniffer's high-risk assessment: 0/100 ## Verdict **Verdict: Critical Risk, trust score 0/100.** rima-rouge.vercel.app shows high-risk / scam indicators. This assessment found strong scam indicators. Do not pay, sign in, or share personal details with this site. Labels: Sensitive Interaction Risk, Governance Risk Assessed 2026-10-26 by automated analysis. Classification confidence 55%. ## Evidence status and limitations Evidence completeness: Not recorded - The real-world operator identity was not independently verified. - Module-level completeness metadata is unavailable for this legacy report. ## At a glance The checks that decide most of this verdict. | Check | Result | Status | | --- | --- | --- | | Malware engines | 17 flagged it (VirusTotal) | Risk | | Google Safe Browsing | Not listed (Google) | Clear | | Abuse reports on the host | 0% confidence (AbuseIPDB, 87 reports; shared hosting inflates reports) | Clear | | Domain age | Not available (No registration record was returned) | Noted | | Certificate | Encrypted connection (Issued by WR1) | Noted | | Hosted by | AMAZON-02 (Server in US) | Noted | ## The page as captured ![Screenshot of the rima-rouge.vercel.app homepage captured during the TrustSniffer assessment](https://trustsniffer.com/outputs/rima-rouge.vercel.app/screenshots/first.png) _What rima-rouge.vercel.app served when TrustSniffer captured it on 2026-10-26. The page may look different now._ ## Key findings - Automated classification: Sensitive Interaction Risk. - At least one reputation service TrustSniffer consulted had flagged this domain at assessment time. ## Full analysis ### Security Alert Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution. This website is a single-page application hosted on a free-tier subdomain of a general-purpose developer hosting platform. Its page title presents it as the "Trezor Suite App (Official)", described as a desktop and web crypto-management tool for a hardware-wallet brand. A visitor is shown a polished crypto-wallet management interface with roughly nine thousand characters of rendered text. Its apparent purpose is to draw cryptocurrency holders into a hardware-wallet management workflow, a category where operators are often impersonated to harvest wallet credentials, recovery phrases, or transaction approvals. ### Scam/Impersonation Risk This is the dominant risk dimension, and the evidence converges on it. A **confirmed blacklist** condition applies: a large cluster of independent security engines currently flags the domain as malicious, including several top-tier endpoint-security vendors, and this independently triggers a hard ceiling on the assessment. The behavioral sandbox adds a second, separate line of evidence. After simulated user interaction, the page showed **strong cloaking behavior**: its rendered content and structure changed substantially, with thousands of DOM mutations and clear semantic and visual divergence from the initial view. A page that presents one face on load and a materially different one after interaction is a recognized evasion pattern, used to defeat automated scanners and reviewers. It is especially concerning here because the site claims to be an official product of a well-known security brand while living on a shared, generic hosting subdomain rather than on any dedicated domain. The sandbox did not observe wallet-connection prompts, clipboard tampering, hidden forms, or outbound data posts to third parties. That limits what has been directly demonstrated, but it does not offset the blacklist condition or the cloaking, and the sandbox may not have triggered the behavior that matters most. No conflicting legal entities appear on the site, so no identity contradiction exists. The risk rests on the blacklist condition, the evasive page behavior, and the unsupported "official" brand claim. Evidence: - Homepage: the page title claims to be the official suite application of a hardware-wallet brand, while the site is served from a free shared-platform subdomain. - Homepage behavior: strong post-interaction cloaking, with 2,310 DOM mutations in a single run and 12 console errors across three successful sandbox runs. - Reputation: 17 security engines rated the domain malicious and one suspicious, including three tier-1 endpoint-security vendors. - Sandbox network activity: zero external requests or posts observed, and no wallet-provider or drainer behavior detected. ### Regulatory Verification Notes The site presents no identifiable operator, legal entity, registration number, or licensing information on the pages captured, so its on-page disclosure state remains unclear. Nothing links the site to the brand it claims to represent, and no third-party regulatory registration was matched. No broker-reputation entry exists for it either. Ownership and governance opacity are therefore present as administrative conditions. Because they sit alongside the confirmed reputation findings, they cannot be treated as benign here. They remove any basis for crediting the "official" claim, and the site's identity cannot be treated as established. Evidence: - Homepage: the "official" brand claim is unaccompanied by any named operator, company details, or licensing reference. - Transport encryption: a domain-validated certificate issued by WR1, valid to 2026-11-27, which confirms encryption only and says nothing about the operator's identity. - Hosting: served from AS16509 (AMAZON-02 - Amazon.com, Inc., US) through shared-platform infrastructure. ### What to Verify Next Any wish to use this application should be settled by reaching the vendor's software through its own official channels, with the address typed manually or taken from the physical product packaging or documentation, rather than through this site or any link leading to it. Anyone who has already entered a recovery phrase, PIN, or wallet credential here should treat the wallet as exposed. Such a user should move assets to a freshly generated wallet from a trusted device and review recent transaction approvals. Security teams may wish to report the page to the hosting platform and to the brand's official abuse channel for takedown review. Evidence: - Homepage: the interface presents a crypto-management workflow, which implies exposure to recovery phrases and transaction signing. - Reputation findings: the current malicious detections indicate that any credential entered on this site is at risk. - Hosting: the shared-platform subdomain means abuse reports can be filed with the platform operator. ### Summary Verdict The site is rated as critical risk. Converging evidence of confirmed external blacklisting, evasive post-interaction page behavior, and an unsupported claim to be an official product of an established security brand defines its posture. Supportive technical signals are present, but they are cosmetic and cannot offset the reputation and behavior findings. The operator's real-world identity is not established, and the evidence is most consistent with a brand-impersonation lookalike. ### Infrastructure Integrity The site resolves to Amazon-hosted addresses behind a shared CDN/WAF platform, with the origin server not observable, so hosting cannot be independently verified. This also means content can be swapped quickly without a visible change in address, which is consistent with the cloaking observed. A large number of abuse reports (87) exists against one of the shared edge addresses. Those reports relate to the platform's shared infrastructure rather than to this site specifically, so they are treated as discounted context. Protective infrastructure is a mitigating factor only and does not offset the reputation risk. ### Closing Assessment The site should not be used for login, entering wallet credentials or recovery phrases, connecting a wallet, or any financial interaction. Passive viewing in an isolated environment is the only proportionate use, and nothing should be downloaded from it. Organizations should consider blocking the domain and alerting users who may have received links to it. _Written analysis generated 2026-10-26 by the TrustSniffer Analysis Engine from the evidence in this report._ ## What the analysis found 3 findings contributed to this verdict, raised by external reputation, behaviour in a sandbox, registration and ownership. ### 01 External reputation - An external threat feed lists this domain: either Google Safe Browsing marked it malicious, or a significant number of malware engines flagged it. (External reputation `rule:EXT_BLACKLIST_CRITICAL`) ### 02 Behaviour in a sandbox - The structure of the page changed sharply while it was loading. (Behaviour in a sandbox `rule:BEHAV_DOM_DENSITY_SPIKE`) - The page rewrote itself after it was interacted with, so what a visitor first sees is not what they end up on. (Behaviour in a sandbox `rule:BEHAV_DOM_DIFF_AFTER_INTERACTION`) - The page produced an unusually high number of errors while it ran. (Behaviour in a sandbox `rule:BEHAV_CONSOLE_ERRORS_HIGH`) ### 03 Registration and ownership - The public registration record for this domain is incomplete. (Registration and ownership `rule:KF_WHOIS_INCOMPLETE`) ### Signals weighed against the site - AbuseIPDB: 87 reports on hosting IP 216.198.79.3 (Vercel, Inc, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website. ## Identity verification | Field | Value | | --- | --- | | Status | UNKNOWN | | Identity score | 50/100 | | Identity verification confidence | 30% | - AI page analysis unavailable (page captured; identity not AI-verified) _Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence._ ## What TrustSniffer observed First-party facts recorded during the assessment of rima-rouge.vercel.app. - The request stayed on rima-rouge.vercel.app. It was not redirected to another domain. (Clear) - It is hosted on AMAZON-02, from a server in US. (Noted) ## Domain intelligence | Field | Value | | --- | --- | | Registrar | Not available | | Hosting | AMAZON-02 - Amazon.com, Inc., US | | Country | US | | Server IP | 216.198.79.3 | | Name servers | Not available | | CDN / edge network | Detected | | Resolved IP addresses | 8 | | Edge IP addresses | 8 | | Likely origin IP addresses | 0 | | SSL issuer | WR1 | | SSL expiry | 2026-11-27 | | Domain age | Not available (no registration date was returned) | | Domain expiry | Not available | | Archive first seen | Not available | | Archive snapshots | Not counted (archive lookup incomplete) | | Reputation | VirusTotal: 17 flagged \| AbuseIPDB: 0% confidence, 87 reports \| Google Safe Browsing: 0 matches | ## About this assessment **Was this report useful?** Tell other people what you think of TrustSniffer, good or bad. An honest review helps others decide whether to rely on these checks. [Review TrustSniffer on Trustpilot](https://www.trustpilot.com/review/trustsniffer.com) A trust score summarises the evidence TrustSniffer could collect about rima-rouge.vercel.app at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present. TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed. ## Related on TrustSniffer - [amlchecks.vercel.app](https://trustsniffer.com/report/amlchecks.vercel.app), a similar name (Critical Risk, 0/100) - [moneybank-liard.vercel.app](https://trustsniffer.com/report/moneybank-liard.vercel.app), a similar name (Critical Risk, 5/100) - [marketsupportingvote.vercel.app](https://trustsniffer.com/report/marketsupportingvote.vercel.app), a similar name (Critical Risk, 24/100) - [marketsupportingvotes.vercel.app](https://trustsniffer.com/report/marketsupportingvotes.vercel.app), a similar name (Critical Risk, 6/100) - [amlget.vercel.app](https://trustsniffer.com/report/amlget.vercel.app), a similar name (Critical Risk, 0/100) - [germanyexchange.vercel.app](https://trustsniffer.com/report/germanyexchange.vercel.app), a similar name (Critical Risk, 0/100) - [safetrust-sigma.vercel.app](https://trustsniffer.com/report/safetrust-sigma.vercel.app), a similar name (Critical Risk, 0/100) - [xmagnetics.vercel.app](https://trustsniffer.com/report/xmagnetics.vercel.app), a similar name (Critical Risk, 0/100) - [tradingspire.com](https://trustsniffer.com/report/tradingspire.com), another site assessed as critical-risk (Critical Risk, 0/100) - [accessfxanalyser.com](https://trustsniffer.com/report/accessfxanalyser.com), another site assessed as critical-risk (Critical Risk, 0/100) - [Every website and wallet TrustSniffer has assessed](https://trustsniffer.com/directory), the full risk directory - [Other domains assessed as high-risk or phishing](https://trustsniffer.com/directory/phishing-domains), same verdict band - [Check another website](https://trustsniffer.com/web-intelligence), run a new assessment - [Check a crypto wallet address](https://trustsniffer.com/on-chain-risk), on-chain screening - [The TrustSniffer Risk Index](https://trustsniffer.com/stats), how this verdict compares ## Guides - [Connect a Wallet to a Scam Site: What Happens](https://trustsniffer.com/blog/connect-wallet-to-a-scam-site-what-happens) - [Stablecoin Freezes, Oct 24, 2026: 15 Wallets](https://trustsniffer.com/blog/stablecoin-freeze-report-2026-10-24) - [Fake Airdrop Sites Show a Number, Not a Transfer](https://trustsniffer.com/blog/fake-airdrop-sites-show-a-number-not-a-transfer) --- *Source: [TrustSniffer](https://trustsniffer.com/report/rima-rouge.vercel.app) — independent automated trust & fraud analysis. Cite as https://trustsniffer.com/report/rima-rouge.vercel.app · assessed 2026-10-26.*