Verdict
This assessment found strong scam indicators. Do not pay, sign in, or share personal details with this site.
tokenpocketpro.vercel.app shows high-risk / scam indicators.
Evidence status and limitations
Evidence completeness: Not recorded
- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.
At a glance
The checks that decide most of this verdict.
| Malware engines | 7 flagged itVirusTotal | Risk |
|---|---|---|
| Google Safe Browsing | Not listedGoogle | Clear |
| Abuse reports on the host | 0% confidenceAbuseIPDB, 101 reports; shared hosting inflates reports | Clear |
| Domain age | Not availableNo registration record was returned | Noted |
| Certificate | Encrypted connectionIssued by WR1 | Noted |
| Hosted by | AMAZON-02Server in US | Noted |
The page as captured
Key findings
- Automated classification: Sensitive Interaction Risk.
- At least one reputation service TrustSniffer consulted had flagged this domain at assessment time.
Full analysis
Security Alert
Fortinet flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.
This website is a single-page landing site titled as the "TokenPocket" secure crypto and DeFi wallet. It lists support for Ethereum, Bitcoin, BSC, HECO and OKXChain wallets, and it is served from a free subdomain of a general-purpose application-hosting platform, not from a standalone brand domain. It presents itself as an access or download page for a multi-chain self-custody wallet, so its apparent purpose is to draw visitors into obtaining or using wallet software under an established crypto-wallet brand.
Scam/Impersonation Risk
The evidence converges on an elevated threat posture. Multiple independent security engines currently flag the site as malicious. One of them is a tier-one vendor, and a further engine rates it suspicious. These detections amount to a confirmed blacklist listing. The homepage also carries a brand-led identity, using a recognised wallet name on a shared-platform subdomain. Nothing independently ties that subdomain to the brand's real operator, and the hostname closely resembles the hosting platform's own domain. Impersonation is not confirmed as a distinct finding, but the combination of a well-known wallet name and an unaffiliated free subdomain is the classic pattern of wallet-lure sites. The homepage's behavioural profile reinforces this. Across every test run, the page contained concealed form elements that are not visible to a visitor. The page also made external submissions, one of them to a destination outside the expected set of trusted services. No wallet-connection prompts, clipboard tampering, wallet-draining routines or password posts to outside parties were observed. Even so, hidden data-capture forms on a crypto-wallet lure page are a serious indicator of credential or seed-phrase harvesting intent. A large volume of abuse reports does exist, but it attaches to a shared edge address of the hosting provider, not to this site specifically. It is therefore discounted and is not counted as independent evidence against the site.
- Homepage: the title and copy present a TokenPocket multi-chain wallet, while the page is delivered from a free subdomain of a shared hosting platform.
- Homepage behaviour: concealed forms were detected in all three test runs, with external submissions observed, one to a non-whitelisted destination.
- Reputation: seven engines rate the site malicious and one suspicious, including one tier-one vendor. 101 abuse reports exist but relate to the provider's shared edge address and are discounted.
- Homepage behaviour: no wallet-connect, drainer or clipboard-hijack activity was observed in any run.
Regulatory Verification Notes
The site discloses no operating company, licence, registration number or legal terms on the captured page. The only identity it offers is the brand name in its title. Because it runs on a shared-platform subdomain, no independently registered domain or named registrant stands behind it. The real-world operator is therefore not independently connected to the wallet brand it advertises. This is a verification gap and a limit on accountability. By itself it is not proof of wrongdoing, and it matters here only because it sits alongside the confirmed security detections. No third-party broker or regulatory-registry match was found. The only technical credentials observed are a basic domain-validated certificate and mainstream cloud hosting, neither of which says anything about who runs the site or how trustworthy that operator is.
- Homepage: no company name, licence number, registration details or legal pages were present in the captured content.
- Hosting: served from AS16509 (AMAZON-02, Amazon.com, Inc., US).
- Transport encryption: the TLS certificate was issued by WR1 at DV (domain-validated) level and is valid to 2026-11-27, which confirms encryption only, not identity.
- Third-party registries: no broker-reputation or regulatory match was found.
What to Verify Next
Any decision to engage should start from the wallet brand's officially published channels, reached independently of this site. The legitimate distribution points for the wallet should be confirmed through the brand's official publisher listings in the established app stores and through channels the brand itself documents. The destination and purpose of the concealed forms on the homepage should be treated as unexplained until the operator can account for them. Any claim that this subdomain is an official brand property should be confirmed with the brand through its known support channels.
- Homepage: the wallet branding and the multi-chain wallet list are the claims that need confirming against the brand's official sources.
- Homepage behaviour: the concealed forms and the external submission recorded in the test runs have no visible, legitimate purpose.
- Hosting identity: the shared-platform subdomain gives no standalone registrant to check, so verification must go through the brand.
Summary Verdict
The site presents a critical trust posture. Confirmed threat-intelligence detections and concealed data-capture behaviour outweigh its technically sound baseline, and its operator identity remains unverified. Its association with a real wallet brand cannot be accepted, and the overall risk is high and clearly cautionary.
Infrastructure Integrity
The site sits behind a content-delivery and web-application-protection layer on the hosting provider's shared edge network in the United States. All observed addresses are edge servers, and no origin server was observable. The infrastructure itself is well run and a mild mitigating factor. It is protective only, though, and cannot offset the reputation risk. Edge-only visibility also prevents independent verification of the true hosting origin and can mask rapid content swaps.
Closing Assessment
The site should be used read-only at most. No wallet should be installed or restored from it. No seed phrase, password, credential or payment detail should be entered on it. Any wallet software should come only from the brand's officially verified distribution channels.
Written analysis generated 2026-10-22 by the TrustSniffer Analysis Engine from the evidence in this report.
What the analysis found
3 findings contributed to this verdict, raised by external reputation, behaviour in a sandbox, registration and ownership.
01 External reputation
- An external threat feed lists this domain: either Google Safe Browsing marked it malicious, or a significant number of malware engines flagged it.External reputation
rule:EXT_BLACKLIST_CRITICAL
02 Behaviour in a sandbox
- The page contained a form a visitor cannot see.Behaviour in a sandbox
rule:BEHAV_HIDDEN_FORMS
03 Registration and ownership
- The public registration record for this domain is incomplete.Registration and ownership
rule:KF_WHOIS_INCOMPLETE
Signals weighed against the site
- AbuseIPDB: 101 reports on hosting IP 216.198.79.195 (Vercel, Inc, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.
Identity verification
| Status | UNKNOWN |
|---|---|
| Identity score | 50/100 |
| Identity verification confidence | 30% |
- AI page analysis unavailable (page captured; identity not AI-verified)
Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence.
What TrustSniffer observed
First-party facts recorded during the assessment of tokenpocketpro.vercel.app.
- The request stayed on tokenpocketpro.vercel.app. It was not redirected to another domain. Clear
- It is hosted on AMAZON-02, from a server in US. Noted
Domain intelligence
| Registrar | Not available |
|---|---|
| Hosting | AMAZON-02 - Amazon.com, Inc., US |
| Country | US |
| Server IP | 216.198.79.195 |
| Name servers | Not available |
| CDN / edge network | Detected |
| Resolved IP addresses | 8 |
| Edge IP addresses | 8 |
| Likely origin IP addresses | 0 |
| SSL issuer | WR1 |
| SSL expiry | 2026-11-27 |
| Domain age | Not available (no registration date was returned) |
| Domain expiry | Not available |
| Archive first seen | Not available |
| Archive snapshots | Not counted (archive lookup incomplete) |
| Reputation | VirusTotal: 7 flagged | AbuseIPDB: 0% confidence, 101 reports | Google Safe Browsing: 0 matches |
About this assessment
A trust score summarises the evidence TrustSniffer could collect about tokenpocketpro.vercel.app at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.
TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.