Is rocket-pool-site.github.io safe? TrustSniffer's moderate-trust assessment: 58/100

Overview

The site is a single-page website presented under the title "Rocket Pool". It is published on a free, shared github.io project subdomain rather than on a dedicated branded domain. It gives a visitor a small page of roughly five thousand characters of text under that name. The apparent purpose is to present itself as a project or service site for that name, but the page content could not be analysed in depth, so the exact offering and business model are not established.

Scam/Impersonation Risk: This is the section where the elevated assessment originates. Several independent threat-intelligence engines currently flag the site as malicious or suspicious, and an external blacklist listing is confirmed. A listing of this kind is a decisive contradiction signal. The site uses the name of a well-known branded project on a generic, freely registrable hosting subdomain. That is the typical pattern of lookalike and impersonation pages. The archive also carries a prior phishing association for this host. Nothing in the evidence confirms phishing or a conflicting legal identity, so the posture rests on the reputation findings rather than on proven fraud. In the sandbox the page made no external network calls, attempted no wallet connection, showed no clipboard manipulation or hidden forms, and did not cloak content after interaction. This is a mitigating observation about current behaviour only. It does not remove the reputation listing, and a page can be changed after a clean capture. The site is also young, and that youth is the main reason the identity link to any real brand is unconfirmed. Evidence:

Regulatory Verification Notes: No regulator, licensing body, or third-party broker database corroborates the site. Its on-page disclosure of any operating company, legal terms, or registration details could not be established from the captured content. That is a verification gap, not evidence of wrongdoing on its own. The reputation listings above, not this gap, drive the cautionary stance. Hosting and certificate details are consistent with a normally configured static site, but they say nothing about who operates it. Evidence:

What to Verify Next: The first step is to establish whether the site is an official property of the project it names. That means finding the project's official domain through its documentation or an independent, offline-sourced channel and comparing it with this host. A second step is to check the project's official channels for any statement about this subdomain. A third is to confirm any official support or contact channel through an independent route before relying on anything the page lists. Any claimed operator, licence, or registration should be checked directly against the relevant public registry. The reputation listings should be re-checked later to see whether they were cleared or reinforced. Evidence:

Summary Verdict: The overall posture is elevated risk. Active threat-intelligence listings outweigh the otherwise orderly technical behaviour of a young site whose real-world operator is not independently established. The legitimacy of the site cannot be assumed, and the evidence does not support treating it as a trusted counterpart for sensitive activity.

Infrastructure Integrity: The site is delivered through Fastly's CDN/WAF, with all observed addresses being edge servers and the origin not observable. The edge addresses sit on the GitHub Pages hosting platform. This is reputable, trusted delivery infrastructure and a mitigating factor only, and it cannot offset the reputation findings. Nine abuse reports were recorded against a shared provider address used by the platform's content delivery network, with low confidence. They attach to shared infrastructure rather than specifically to this site, so they are treated as a soft contextual signal. Evidence:

Closing Assessment: Treat the site as untrusted for anything beyond passive viewing. Do not sign in, enter credentials, connect a wallet, approve transactions, or make payments on it. Use only access routes taken from the project's independently confirmed official channels.

• Homepage: titled "Rocket Pool", served from a shared github.io project subdomain, which gives no independent link to a verified operator.
• Domain provenance: registered 2025 (~1.04 years old); the web archive holds 2 snapshots, both dated 2025-10-09, tracking 1 year.
• Reputation: 3 threat-intelligence engines rate the site malicious and 1 suspicious; a blacklist listing is confirmed.
• Sandbox behaviour (3 of 3 runs successful, HTTP 200 stable): 0 external requests, 0 wallet-connect attempts, 0 console errors.
• Regulatory status: no third-party regulatory registration or broker-database match was found for the site.
• Homepage: on-page disclosure of an operator, jurisdiction, or licence is unclear.
• Hosting: served from AS54113 (Fastly), United States.
• Transport encryption: TLS certificate issued by YR1 (DV, domain validation only), valid to 2026-12-29. DV confirms control of the domain, not the identity of an organisation.
• Homepage: the name "Rocket Pool" is presented without an independently verifiable operator.
• Reputation: the current threat-intelligence listings are the benchmark against which any later re-check should be compared.
• Domain history: the site's first archive capture is dated 2025-10-09, which leaves only a short window for assessing continuity.
• Hosting infrastructure: Fastly (AS54113), four edge IPs observed, no origin candidates.
• Shared-address abuse reports: 9, low confidence, attributed to shared provider infrastructure.

Signals weighed against the site

• AbuseIPDB: 9 reports on hosting IP 2606:50c0:8000::153 (GitHub, Inc., Content Delivery Network), 12% confidence. The reports are attributed to shared infrastructure, not specifically to this website.