Verdict
This assessment found strong scam indicators. Do not pay, sign in, or share personal details with this site.
zerionconnect.web.app shows high-risk / scam indicators.
Evidence status and limitations
Evidence completeness: Not recorded
- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.
At a glance
The checks that decide most of this verdict.
| Malware engines | 14 flagged itVirusTotal | Risk |
|---|---|---|
| Google Safe Browsing | Not listedGoogle | Clear |
| Abuse reports on the host | 3% confidenceAbuseIPDB, 4 reports; shared hosting inflates reports | Clear |
| Domain age | Not availableNo registration record was returned | Noted |
| Certificate | Encrypted connectionIssued by WR4 | Noted |
| Hosted by | FASTLYServer in US | Noted |
The page as captured
Key findings
- Automated classification: Sensitive Interaction Risk.
- At least one reputation service TrustSniffer consulted had flagged this domain at assessment time.
Full analysis
Security Alert
Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.
The domain zerionconnect.web.app is a subdomain on a shared web-application hosting platform. At the time of capture, its homepage returned a "Site Not Found" page with only a few hundred characters of text. The name pairs a known crypto-wallet brand term with "connect", which suggests a wallet-connection or portfolio-access service. The captured content did not show what the site offers, who operates it, or what business it supports.
Scam/Impersonation Risk
This is the decisive section. The site carries a confirmed blacklist listing and an elevated-risk posture. Multiple independent security engines, including several tier-one vendors, classify the domain as malicious. The detection volume is high enough to trigger an automatic severe cap on the assessment. Active detections of this kind are treated as decisive. Neither the technical hygiene seen elsewhere nor the neutral behavioral findings can offset them. Conflicting legal identities, brand impersonation and phishing were not independently confirmed by the page-level analysis. The blacklist and malicious-detection record is therefore the contradiction that drives the cautionary stance. The domain name's pairing of a recognizable wallet-ecosystem term with "connect" matches a common pattern used to lure users into wallet-linking flows. That is a pattern observation, not a confirmed impersonation. The sandbox did not observe wallet-drainer activity, clipboard manipulation, hidden or externally posting password forms, or cloaking. Those results may only reflect that the captured page was an empty not-found shell with little to exercise. They do not reduce the weight of the external detections. Four abuse reports were logged against the shared edge IP. They concern provider infrastructure used by many tenants and are not specific to this domain, so they add little site-specific weight. No contact email anomaly was observed. Evidence:
- Homepage capture: returned a "Site Not Found" page with an HTTP 404 status and about 311 characters of text, so no product, brand or operator content could be assessed.
- External reputation: 14 security engines flagged the domain as malicious and 1 as suspicious, including three tier-one vendors. The reputation record is flagged as a confirmed blacklist.
- Behavioral sandbox: across 3 successful runs, 256 external XHR/fetch calls and 29 external POST requests were observed. About 99.7% of the traffic was external, and none went to non-whitelisted destinations. No wallet-connect, drainer, clipboard-hijack or hidden-form activity was detected.
- Abuse reports: 4 reports against the shared edge address. These were attributed to shared infrastructure and carry a very low confidence score.
Regulatory Verification Notes
The captured page contains no legal-entity name, licensing or registration information, terms page, or privacy policy. Regulatory standing and operator identity therefore cannot be established from the site itself. The absence of these disclosures is a verification gap, not independent evidence of wrongdoing. A site that connects to wallets or handles financial interactions would normally be expected to publish them. No third-party broker or regulator-style listing matched this domain, and the domain is not recognized as a DeFi protocol. Neither is a regulatory finding, and neither supports a legitimacy conclusion. The only affirmative technical signals are a valid transport-encryption certificate and a mainstream hosting provider. These show only that the site is correctly served over HTTPS. They are not evidence of legitimacy. Evidence:
- Homepage capture: no operator, company, licensing or contact disclosures were present in the captured content.
- Transport encryption: the TLS certificate was issued by WR4 at domain-validated (DV) level, valid to 2026-12-22. DV confirms control of the domain, not the operator's identity.
- Hosting: the site is served from AS54113 (Fastly, US).
What to Verify Next
Confirm independently whether the real brand the name evokes operates this address. Use the brand's official website, official social channels, or a known app listing. Do not rely on links from messages, ads or search results. Check whether the operator holds a licence or registration with the relevant financial or virtual-asset regulator. If the site is encountered through a message, advert or QR code, trace how it was reached and treat that source as suspect. Report the address to the brand's security team and to the hosting platform's abuse channel. Confirm official support channels through an offline or independent route. If wallet connections or approvals were already made at this address, review and revoke them, and move assets from any exposed wallet. Evidence:
- Homepage capture: no identifying operator or product information was available to validate against an external registry.
- External reputation: the malicious classification by multiple security engines makes brand-side confirmation the primary check.
- Behavioral sandbox: no wallet-connect flow was exercised, so the site's interaction behavior remains untested.
Summary Verdict
The assessment is critical and cautionary. A confirmed blacklist record and strong malicious detections from several leading security engines outweigh all benign technical hygiene. The site's identity is unverified, and no legitimate business function could be established from its content. The deterministic verdict stands at the lowest trust tier, with a sensitive-interaction risk profile.
Infrastructure Integrity
The domain is served through Fastly's CDN/WAF (AS54113, US). Both observed addresses, IPv4 and IPv6, are edge servers, and the origin could not be seen. The certificate is valid, and the platform is a mainstream, trusted provider. These are mitigating factors only and do not offset the reputation findings. Edge-only visibility prevents independent verification of the underlying hosting and can mask rapid content changes.
Closing Assessment
Do not log in, connect a wallet, enter credentials or seed phrases, sign transactions, or make any payment on this site. At most, treat it as untrusted for passive viewing in an isolated environment, and obtain the official brand address through independent channels.
Written analysis generated 2026-10-22 by the TrustSniffer Analysis Engine from the evidence in this report.
What the analysis found
3 findings contributed to this verdict, raised by external reputation, behaviour in a sandbox, registration and ownership.
01 External reputation
- An external threat feed lists this domain: either Google Safe Browsing marked it malicious, or a significant number of malware engines flagged it.External reputation
rule:EXT_BLACKLIST_CRITICAL
02 Behaviour in a sandbox
- Most of what the page loaded came from other domains rather than from this one.Behaviour in a sandbox
rule:BEHAV_EXTERNAL_RATIO_HIGH - The structure of the page changed sharply while it was loading.Behaviour in a sandbox
rule:BEHAV_DOM_DENSITY_SPIKE - The page made many background requests to other domains while it was open.Behaviour in a sandbox
rule:BEHAV_EXTERNAL_XHR_HEAVY - The page sent data to other domains many times while it was open.Behaviour in a sandbox
rule:BEHAV_EXTERNAL_POSTS_HEAVY
03 Registration and ownership
- The public registration record for this domain is incomplete.Registration and ownership
rule:KF_WHOIS_INCOMPLETE
Signals weighed against the site
- AbuseIPDB: 4 reports on hosting IP 2620:0:890::100 (Google LLC, Content Delivery Network), 3% confidence. The reports are attributed to shared infrastructure, not specifically to this website.
Identity verification
| Status | UNKNOWN |
|---|---|
| Identity score | 50/100 |
| Identity verification confidence | 30% |
- AI page analysis unavailable (page captured; identity not AI-verified)
Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence.
What TrustSniffer observed
First-party facts recorded during the assessment of zerionconnect.web.app.
- The request stayed on zerionconnect.web.app. It was not redirected to another domain. Clear
- It is hosted on FASTLY, from a server in US. Noted
Domain intelligence
| Registrar | Not available |
|---|---|
| Hosting | FASTLY - Fastly, Inc., US |
| Country | US |
| Server IP | 2620:0:890::100 |
| Name servers | Not available |
| CDN / edge network | Detected (fastly) |
| Resolved IP addresses | 2 |
| Edge IP addresses | 2 |
| Likely origin IP addresses | 0 |
| SSL issuer | WR4 |
| SSL expiry | 2026-12-22 |
| Domain age | Not available (no registration date was returned) |
| Domain expiry | Not available |
| Archive first seen | Not available |
| Archive snapshots | Not counted (archive lookup incomplete) |
| Reputation | VirusTotal: 14 flagged | AbuseIPDB: 3% confidence, 4 reports | Google Safe Browsing: 0 matches |
About this assessment
A trust score summarises the evidence TrustSniffer could collect about zerionconnect.web.app at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.
TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.