Is slushdesktop.com a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

Slushdesktop.com is a single-page product site for "Slush Desktop," presented as a non-custodial Sui blockchain wallet for Windows and macOS. Its homepage promotes a six-workspace desktop application covering portfolio tracking, transaction history, staking and DeFi "Earn" strategies, connections to Sui apps, NFT management and device-security review. It carries prominent download buttons for both operating systems and shows a mock dashboard populated with fictional balances. The apparent purpose is to distribute wallet software to Sui users. The page does not say how the operator earns revenue.

Scam/Impersonation Risk

The evidence converges on elevated risk driven by external reputation and sandbox findings. Several independent threat-intelligence sources currently flag the domain as malicious or suspicious, including at least one top-tier security vendor, and the domain is on a confirmed blacklist. During controlled sandbox execution, the page also triggered a malware-execution indicator. This matters because the site's core call to action is to download and install executable software that would later hold private keys and funds. A wallet installer from an unvetted source is a recognised vector for credential theft and wallet-draining malware. The domain was registered only weeks ago, yet it presents a wallet brand and software download. The homepage content itself is comparatively benign. It has no login or payment form, no request for a seed phrase or private key, and no hidden forms. Its figures (a $48,291.42 portfolio, a 250 SUI to 410 USDC swap, 1,000 SUI staked) are labelled as fictional demonstration data, and the page states that recovery phrases are never requested. The sandbox saw no external network posts, no wallet-connect or drainer behaviour, and no clipboard manipulation. Content analysis did not detect brand impersonation, and no conflicting legal identities appear. The risk is therefore concentrated in the blacklist status and the downloadable binaries, not in on-page deception. The independent verdict is cautionary, and the clean on-page behaviour does not offset it. The wallet is not shown to be genuine, and the site's own security claims cannot be relied on while the download path is flagged. Evidence:

• Homepage: Windows and macOS download buttons are the primary calls to action, so the installer is the main exposure.
• Domain provenance: registered 2026-09-29 through NICENIC INTERNATIONAL GROUP CO., LIMITED (about 0.06 years old, 22 days), with expiry set to 2027-09-29.
• Web archive: only 2 snapshots, both captured 2026-09-29 (1 year tracked), so there is no meaningful history to corroborate the brand.
• Sandbox: 3 of 3 runs completed with no external posts, forms, or wallet-drainer behaviour, but a malware-execution indicator was raised.

Regulatory Verification Notes

The homepage identifies no operating company, registered address, jurisdiction, or licensing status. The only identity artifact is the copyright line "Slush Desktop Experience," which names no registered legal entity. The site claims no financial licence and cites no registration number. It also describes staking and DeFi features as connections to external services, not as products it issues, and its swap flow mentions third-party provider fees without naming the providers. Ownership and governance are opaque. The site gives no way to tie it to a named, accountable organisation, and that matters more here because the product handles user funds. No third-party broker or regulatory-database entry matched this domain. Reputational context is therefore limited to the threat-intelligence signals above, which are a security matter, not a licensing verdict. Evidence:

• Homepage footer: the copyright line "Slush Desktop Experience" is the only identity statement, and no legal entity, registration number, or licence is displayed.
• Homepage content: the swap flow cites third-party provider fees and the staking and DeFi features link to external services, with no stated revenue model or named counterparties.
• Hosting: served from AS16509 (AMAZON-02 - Amazon.com, Inc., US).
• Transport encryption: a domain-validated (DV) TLS certificate issued by YR2, valid to 2026-12-28 (67 days remaining). DV validation confirms control of the domain only and says nothing about who operates it.

What to Verify Next

Before any download or wallet interaction, the wallet's genuine publisher and distribution channel should be confirmed through an independent route, such as the project's established ecosystem listings or documentation reached by a separately obtained, trusted path, not through links on this site. Any installer should not be run unless its origin and cryptographic signature or checksum can be matched to publisher-confirmed values. The operating entity behind "Slush Desktop Experience" should be identified through an authoritative channel. Support and contact routes should be confirmed offline or through the publisher's verified channels. Until then, no recovery phrase, private key, or wallet connection should be entered anywhere linked to this domain. Evidence:

• Homepage: the download buttons and the claim that recovery phrases are never requested cannot be treated as assurances while the domain's reputation is adversely flagged.
• Homepage content: the Earn and Apps workspaces refer to staking strategies, projected APY values and three "connected" DeFi and trading apps. These would require wallet permissions, so the genuine publisher must be established first.
• Homepage tooling: an embedded LiveChat widget is present, and any support conversation conducted through it should not be treated as confirmation of publisher identity.

Summary Verdict

The site is assessed as high-risk and in a clearly cautionary posture. The combination of confirmed external blacklist and malicious detections, a malware-execution indicator in sandbox testing, and an unverified operator behind a very new domain that offers wallet software outweighs the otherwise benign and professionally presented page. Its legitimacy cannot be established, and it should be treated as unsafe for any credential, financial, or software-installation use.

Infrastructure Integrity

The site is served through Vercel's CDN/WAF on Amazon-operated cloud infrastructure in the United States, behind a valid TLS certificate. All observed addresses are edge nodes, and the origin server could not be observed, which limits independent hosting verification. This protective infrastructure is a mitigating factor only and does not offset the reputation findings. The 61 abuse reports against the observed edge IP carry a low confidence rating and relate to a shared, whitelisted CDN address used by many unrelated sites. They are therefore discounted and not attributed to this domain.

Closing Assessment

The site should be treated as read-only at most. No wallet software should be downloaded or installed from it, and no seed phrase, key, credential, or funds should be exposed to anything obtained through it. Any wallet needed should be sourced only from a publisher channel confirmed independently of this domain. If an installer has already been run, the device should be scanned and any wallet used with it should be treated as potentially compromised.

Signals weighed against the site

• AbuseIPDB: 61 reports on hosting IP 216.198.79.65 (Vercel, Inc, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.