Verdict
This assessment found strong scam indicators. Do not pay, sign in, or share personal details with this site.
rocketpoolnet.web.app shows high-risk / scam indicators.
| What this site appears to be | Official-looking landing page for Rocket Pool, a decentralised Ethereum liquid staking protocol. It promotes liquid staking (rETH) and node staking with displayed APRs, a Saturn upgrade, governance, DeFi integrations and community channels. No forms, login prompts or fraud signals are visible in the supplied text. |
|---|
Evidence status and limitations
Evidence completeness: Not recorded
- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.
At a glance
The checks that decide most of this verdict.
| Malware engines | 1 flagged itVirusTotal | Risk |
|---|---|---|
| Google Safe Browsing | Not listedGoogle | Clear |
| Abuse reports on the host | 4% confidenceAbuseIPDB, 4 reports; shared hosting inflates reports | Clear |
| Domain age | Not availableNo registration record was returned | Noted |
The page as captured
Key findings
- Automated classification: Sensitive Interaction Risk.
- At least one reputation service TrustSniffer consulted had flagged this domain at assessment time.
- The operator behind the site could not be independently connected to a real-world brand or person.
Full analysis
Overview
This website is a single-page landing site that presents itself as Rocket Pool, a decentralised Ethereum liquid staking protocol. Its homepage promotes staking ETH in exchange for rETH, a liquid staking token, and running a node with RPL rewards. It also covers a "Saturn" protocol upgrade, governance, DeFi integrations and community channels. It runs on a shared free-hosting subdomain rather than a standalone domain. Its apparent purpose is to draw visitors into depositing ETH and interacting with a staking product.
Scam/Impersonation Risk
A current threat-intelligence listing identifies this site as an active source of phishing, and this is the decisive finding. The site is the listed actor, not a bystander. The listing was most recently observed in the days just before this assessment. One or more reputation engines also flag the domain as malicious or suspicious, and these detections corroborate the listing. This is a confirmed blacklist condition. The homepage reads as a faithful rendition of a well-known protocol. It offers liquid staking from 0.01 ETH, shows an approximate 2.35% APR for liquid staking and about 3.32% plus RPL rewards for node staking, and offers 4 ETH validators. It also displays headline counters of ETH staked, node operators and "151+" regions that cannot be verified from the page. Because any staking product requires the visitor to hand over funds before receiving service, a convincing copy of an established brand under a listed phishing address is exactly the pattern used to redirect deposits or wallet approvals. Four abuse reports exist against a shared content-delivery address associated with the site's hosting. Because that address is shared, these reports carry limited weight on their own, and they are not discounted from the overall picture. No conflicting legal entities were observed across the site's pages. The page itself showed no login form, hidden forms or credential-harvesting prompts, and sandbox runs showed no wallet-drainer or clipboard-hijack behaviour. Any later redirection or approval request would only appear once a visitor engages, so the clean page behaviour does not offset the active listing.
- Threat-intelligence listing classed as phishing, with the site as the actor, last seen 2026-10-18.
- Homepage: the staking-product copy and the unverifiable counters sit alongside an unverified operator identity, so nothing on the page ties it to the genuine protocol.
- Three sandbox runs of the homepage recorded no external form posts, no wallet-drainer activity and no hidden forms, although 18 console errors were logged.
- The web archive holds a single snapshot, first captured 2026-09-25, and the domain has no matching DeFi protocol listing.
Regulatory Verification Notes
The homepage claims no licence, registration or supervisory authority. No audit reports or security disclosures appear beyond a "Security" navigation link. Legal and governance disclosure on the page is unclear, and ownership is not independently established, so the operator cannot be connected to the real Rocket Pool project. The page's only authority comes from its own branding. The site's metadata is thin: it has no meta description, no canonical reference and no structured data, which is unusual for a site presenting itself as an established protocol. No third-party broker record exists for the site, so there is no external regulatory context to weigh. This section treats these points as disclosure and verification gaps only. The reputational findings above are the basis for the cautionary posture.
- Homepage: no licence, registrar or regulator reference is published, and the unverified operator identity is carried on the page's own claims alone.
- Transport encryption: a domain-validated TLS certificate issued by WR4, valid to 2026-12-22. This confirms an encrypted connection only, not who operates the site.
- Hosting infrastructure: served from AS54113 (Fastly, Inc., US).
What to Verify Next
The protocol's genuine address should be taken from an independent, trusted source, such as the project's official documentation or an established aggregator, and compared character by character with this site's address. Contact channels, community links and any governance or documentation references on the page should be confirmed through independent routes. Any claim about audits or licensing should be checked directly with the named auditor or relevant registry. Any funds or wallet approvals already exposed to this site should be reviewed with a wallet-permission checker.
- Homepage: the "Security", governance and documentation navigation items give no independently confirmable destination within the page text.
- The site is hosted on a shared subdomain, so its address differs from any domain the genuine project would be expected to control.
- The threat listing was recorded 2026-10-18, so a repeat check against current feeds should be made before any later reassessment.
Summary Verdict
This site carries an elevated, high-risk posture. A current phishing listing, corroborated by independent reputation detections, outweighs the polished content and benign page behaviour. Its operator identity is unverified, and the brand it presents cannot be tied to the genuine project. That combination is incompatible with trust.
Infrastructure Integrity
Content is delivered through major CDN and edge providers, with Fastly as the primary network and Cloudflare also detected. All observed addresses are edge servers, and DNS resolved cleanly. The transport certificate is valid, and the infrastructure is sound. These protections only mitigate technical exposure and do not offset the reputational findings, since phishing content can be served from reputable platforms.
Closing Assessment
The site should not be used for login, wallet connection, approvals or deposits of any kind. If it has already been visited and a wallet was connected, token approvals should be revoked and affected assets moved to a fresh wallet. Any staking activity should begin only from an address obtained independently of this site.
Written analysis generated 2026-10-19 by the TrustSniffer Analysis Engine from the evidence in this report.
What the analysis found
4 findings contributed to this verdict, raised by governance, external reputation, behaviour in a sandbox, page content.
01 Governance
- A threat-intelligence feed currently lists a file on this site as malicious, and that caps the score while the listing is live.Governance
rule:gov_active_threat_listing
02 External reputation
- A small number of malware engines flagged this domain. On its own this is a weak signal.External reputation
rule:EXT_BLACKLIST_MEDIUM
03 Behaviour in a sandbox
- The page produced an unusually high number of errors while it ran.Behaviour in a sandbox
rule:BEHAV_CONSOLE_ERRORS_HIGH
04 Page content
- The page has no description for search engines, which established sites usually provide.Page content
rule:PAGE_SEO_MISSING_META - The page carries none of the structured previews for search and social sharing that established sites usually provide.Page content
rule:PAGE_SEO_NO_STRUCTURED
Signals weighed against the site
- AbuseIPDB: 4 reports on hosting IP 2620:0:890::100 (Google LLC, Content Delivery Network), 4% confidence. The reports are attributed to shared infrastructure, not specifically to this website.
Identity verification
| Status | UNVERIFIED |
|---|---|
| Identity score | 30/100 |
| Identity verification confidence | 50% |
- No on-site identity signals detected
Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence.
What TrustSniffer observed
First-party facts recorded during the assessment of rocketpoolnet.web.app.
- The request stayed on rocketpoolnet.web.app. It was not redirected to another domain. Clear
Domain intelligence
| Registrar | Not available |
|---|---|
| Hosting | Not available |
| Country | Not available |
| Server IP | 2620:0:890::100 |
| Name servers | Not available |
| CDN / edge network | Lookup incomplete |
| SSL issuer | WR4 |
| SSL expiry | 2026-12-22 |
| Domain age | Not available (no registration date was returned) |
| Domain expiry | Not available |
| Archive first seen | Not available |
| Archive snapshots | Not available |
| Reputation | VirusTotal: 1 flagged | AbuseIPDB: 4% confidence, 4 reports | Google Safe Browsing: 0 matches |
About this assessment
A trust score summarises the evidence TrustSniffer could collect about rocketpoolnet.web.app at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.
TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.