Is rocketpool-stake.vercel.app a scam? TrustSniffer's high-risk assessment: 23/100

Overview

This website is a single-page ETH staking front end titled "RocketPool Staking — Stake ETH & Earn Rewards | Decentralized Staking Protocol". It uses the name of a well-known decentralized staking protocol and invites visitors to stake Ether and earn rewards. It runs on a free subdomain of a general-purpose application hosting platform, not on a domain of its own. Its apparent purpose is to act as a gateway into a staking flow, where a visitor would be asked to commit crypto-assets.

Scam/Impersonation Risk

The assessment is clearly cautionary. Several independent threat-intelligence sources flag the site. More than one security engine classifies it as malicious and another as suspicious, and an external blacklist listing is confirmed. Because blacklist status is confirmed, the elevated posture rests on these listings and not on any inference. No conflicting legal identities, confirmed phishing kit, or confirmed brand impersonation were observed. The risk therefore comes from reputation, not from identity contradiction. The context sharpens it. The page borrows the name and vocabulary of an established staking protocol, and a counterfeit staking interface is a standard vehicle for wallet-approval and deposit-diversion fraud. A legitimate protocol would normally operate from its own recognizable domain, and the DeFi directory lookup returned no listing for this one. A large body of abuse reports also exists for the hosting address. These are attributed to the shared provider infrastructure, not to this site, and carry little weight on their own. Live behavioral testing was reassuring on the mechanics. It found no wallet-drainer behavior, no clipboard manipulation, no hidden or externally posting forms, no cloaking, and no suspicious inline scripts. Page loads were stable and the few third-party requests went to recognized destinations. This shows that the tested session did not exhibit malicious behavior. It does not offset the independent threat listings, and a hostile payload can be delivered later or only to specific visitors. Evidence:

• Homepage: the page title presents the site as a protocol staking service, yet the domain is a subdomain of a shared hosting platform. The DeFiLlama directory shows no listing for it.
• Reputation checks: two engines rate the domain malicious and one suspicious; an external blacklist listing is also confirmed.
• Hosting address: 87 abuse reports, most recently on 2026-10-21, apply to the shared Vercel (CDN) address and are discounted as shared-infrastructure noise.
• Behavioral sandbox, 3 of 3 runs successful: zero wallet-connect or drainer events, zero external form posts, and zero console errors.

Regulatory Verification Notes

No legal, licensing, or entity-identification content was available to tie this site to a real-world operator. The link between the site and any real organization, or the protocol whose name it uses, remains unconfirmed. No third-party source corroborates a regulatory registration, and the broker-reputation dataset returned no match. This is a verification gap and not proof of wrongdoing. Here it compounds the reputational listings, because a service that takes custody-adjacent actions on crypto-assets would be expected to be traceable to an accountable entity. The remaining technical facts are neutral. The site uses valid transport encryption, but that certificate shows only that the connection is encrypted. It does not authenticate who runs the service. Evidence:

• Transport encryption: TLS certificate issued by WR1 (domain-validated only, no organization validation), valid to 2026-11-27.
• Hosting: served from AS16509 (AMAZON-02, Amazon.com, Inc., US, ARIN registry).
• No broker or regulator-style reputation record matched this domain.

What to Verify Next

The first step is to obtain the official staking address of the protocol through an independent route, such as the protocol's documentation, its verified social accounts, or a trusted aggregator. That address should then be compared with this one. Any claim of affiliation should be confirmed with the protocol's own team. The second step is to ask the project through an offline or independent channel whether it operates or endorses this deployment. The third step is to re-check the domain against threat-intelligence listings before any change in posture. Any later delisting should be treated as a reason to reassess, not as proof of legitimacy. Official support and contact channels should be confirmed only through those independent routes. Evidence:

• Homepage: the staking offer and protocol branding are the claims that need independent confirmation.
• Directory lookup: no DeFi protocol listing exists for this domain, so no third-party confirmation of the deployment is available.
• Reputation checks: the current malicious and suspicious classifications are the baseline against which any future delisting should be compared.

Summary Verdict

The available evidence supports an elevated-risk posture. The site is a staking front end whose independent threat listings are decisive and are not outweighed by its clean technical session behavior. Its real-world operator is unverified, and nothing presently supports treating it as the genuine service whose name it uses. Benign behavior in testing and ordinary encryption lower the likelihood of overt technical abuse but do not change the overall assessment.

Infrastructure Integrity

The site is delivered through the hosting platform's CDN edge. All six observed addresses are edge nodes on Amazon's network, and the origin server was not observable. This is a mitigating factor for availability and baseline hardening only. Protective infrastructure cannot offset the external threat detections, and the edge-only visibility prevents independent verification of what actually stands behind the page. It also makes it easier to change content quickly without any visible infrastructure change.

Closing Assessment

Browsing the page without interacting is the only use consistent with the evidence. Visitors should not connect a wallet, sign any approval or transaction, deposit funds, or enter credentials here. Any staking should be done only through an address confirmed independently from the protocol's official channels.

Signals weighed against the site

• AbuseIPDB: 87 reports on hosting IP 64.29.17.195 (Vercel, Inc, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.