Is murmelt.com safe?
http://murmelt.com/
Checked on
How we checked
Coverage: strong · 5 of 6 applicable core capabilities
- Antivirus (57 of 91 engines answered) · saved result: did not fully complete
- Google Safe Browsing: completed
- page reading: completed
- page capture: completed
- domain records: completed
- web research: completed
Murmelt is a browser-based Nostr chat client with no detected threats, but it is a 86-day-old domain run by an undisclosed operator.
Murmelt describes itself as a client application that runs in the browser and connects to third-party Nostr relays for messaging, with file attachments going to third-party Blossom servers. Our checks found no malware, phishing or payment fraud mechanics: Safe Browsing returned no warning, the TLS connection is valid, and the hosting IP has no abuse reports. The score reflects the thin track record rather than any observed attack — the domain is only 86 days old, the people behind it are not named, and the site's own terms disclaim all responsibility for what happens on the relays it connects to.
Saved site captureCaptured safely during this scanSaved antivirus result from Sep 11, 2026: no detections across 57 enginesWhere this site sits
- Dangerous1–20
- High Risk21–44
- Moderate Risk45–69
- Low Risk70–84
- Safe85–100
The score combines saved evidence strength and analysis quality. Coverage is reported separately.
Why 78/100
Low Risk covers scores 70–84. 2 findings pulled the score down; 2 pushed it up.
What pulled the score down
- ModerateThe site names no company, address or individual behind the client, describing itself only as browser software that is not a service provider.
- MinorThe registrable domain is only 86 days old, so there is little history to judge the operator by.
What pushed the score up
- SupportsSafe Browsing returned no threat warning, the TLS connection is valid, and the hosting IP has zero abuse reports.
- SupportsThe site publishes a contact mailbox on its own domain, info@murmelt.com.
No points per finding are stored for this report: our analysis weighed all findings together to set the score. Each finding shows its saved severity instead (Decisive, Strong, Moderate or Minor).
01 · Investigation Brief
Investigation Brief
Murmelt describes itself as a client application that runs in the browser and connects to third-party Nostr relays for messaging, with file attachments going to third-party Blossom servers. Our checks found no malware, phishing or payment fraud mechanics: Safe Browsing returned no warning, the TLS connection is valid, and the hosting IP has no abuse reports. The score reflects the thin track record rather than any observed attack — the domain is only 86 days old, the people behind it are not named, and the site's own terms disclaim all responsibility for what happens on the relays it connects to.
A free chat client that hands messaging to third-party relays
The page offers a single action, a "Start Murmelt" button that opens the chat application in the browser. The site's own text says the software is a client only: it is not a service provider, relay operator or hosting platform, and it does not store, route or relay messages or files itself.
Message routing happens through Nostr relays the user picks, and file attachments are uploaded to Blossom servers. The site states plainly that each relay has its own terms, policies and moderation practices and that it is not responsible for their availability, reliability or content policies. That is a normal architecture for decentralized chat, but it also means the site itself is not the party holding your data or moderating what you see.
Identity is a cryptographic key pair generated locally, and the site warns that the private key never leaves the device except when exported and that a lost key cannot be recovered because there is no backend or support team for account recovery. Anyone using it should treat key backup as their own responsibility.
Clean technical checks, but a young domain and an unnamed operator
The saved technical checks are clean: the browser threat feed returned no threat warning, the TLS check found a valid encrypted connection, and the hosting IP carries an abuse confidence score of 0 out of 100 across zero saved reports. Nothing in the evidence shows a download, a credential form, a payment page or a redirect chain.
The counterweight is track record. The registrable domain is 86 days old, and the site does not name a company, address or specific operator, describing itself only as a client application. A contact mailbox on the site's own domain, info@murmelt.com, is published, which is a small positive sign, but it does not establish who is maintaining the code.
The terms also state the app is provided "as is" without warranty, may change or stop working at any time, and that the operators accept no liability for loss or damage from its use. Combined with the missing operator identity, that is a reason to keep expectations modest rather than a sign of fraud.
Why the score is 78
The saved checks found no material threat, but the evidence was not strong enough for the highest Safe tier.
02 · Security Evidence
Security evidence
Antivirus Engines
0/ 91
No detectionsSaved analysis from September 11, 2026 - stale
No detections across 57 engines that rated this URL
No antivirus engine that answered raised an adverse result; 34 had no rating for this URL. This is one signal, not a guarantee.
- Malicious
- 0
- Suspicious
- 0
- Total
- 91
All 91 engine results
- 0xSI_f33d - Unrated
- Abusix - Clean
- Acronis - Clean
- ADMINUSLabs - Clean
- AILabs (MONITORAPP) - Clean
- AlienVault - Clean
- alphaMountain.ai - Unrated
- AlphaSOC - Unrated
- Antiy-AVL - Clean
- ArcSight Threat Intelligence - Unrated
- AutoShun - Unrated
- Bfore.Ai PreCrime - Unrated
- BitDefender - Clean
- Bkav - Unrated
- BlockList - Clean
- Blueliv - Clean
- Certego - Clean
- ChainPatrol - Unrated
- Chong Lua Dao - Unrated
- CINS Army - Clean
- CRDF - Clean
- Criminal IP - Unrated
- CSIS Security Group - Unrated
- CTX AI - Clean
- Cyan - Unrated
- Cyble - Clean
- CyRadar - Clean
- desenmascara.me - Clean
- DNS8 - Unrated
- Dr.Web - Clean
- EmergingThreats - Clean
- Emsisoft - Clean
- Ermes - Unrated
- ESET - Clean
- ESTsecurity - Clean
- Forcepoint ThreatSeeker - Clean
- Fortinet - Clean
- Fortra - Unrated
- G-Data - Clean
- GCP Abuse Intelligence - Unrated
- Google Safe Browsing - Clean
- GreenSnow - Clean
- GreyNoise - Unrated
- Gridinsoft - Unrated
- Guardpot - Unrated
- Heimdal Security - Clean
- Hunt.io Intelligence - Unrated
- IPsum - Clean
- Juniper Networks - Clean
- K7AntiVirus - Unrated
- Kaspersky - Clean
- LevelBlue - Clean
- Lionic - Clean
- Lumu - Unrated
- Malwared - Clean
- MalwarePatrol - Clean
- MalwareURL - Unrated
- Mimecast - Unrated
- Netcraft - Unrated
- OpenPhish - Clean
- PhishFort - Unrated
- Phishing Database - Clean
- Phishtank - Clean
- PREBYTES - Clean
- PrecisionSec - Unrated
- Quick Heal - Clean
- Quttera - Clean
- Rising - Clean
- SafeToOpen - Unrated
- Sangfor - Clean
- Sansec eComscan - Unrated
- Scantitan - Clean
- SCUMWARE.org - Clean
- Seclookup - Clean
- Snort IP sample list - Unrated
- SOCRadar - Unrated
- Sophos - Clean
- StopForumSpam - Clean
- Sucuri SiteCheck - Clean
- ThreatHive - Clean
- URLhaus - Clean
- URLQuery - Unrated
- Viettel Threat Intelligence - Clean
- VIPRE - Unrated
- ViriBack - Clean
- VX Vault - Clean
- Webroot - Clean
- Xcitium Verdict Cloud - Clean
- Yandex Safebrowsing - Clean
- ZeroCERT - Clean
- ZeroFox - Unrated
How security vendors categorise this site
- Forcepoint ThreatSeekernewly registered websites
- Googlesocial_media
Each vendor’s own label for the site, saved with the antivirus result. Labels are separate from the engine verdicts above and can disagree with each other.
Security Scans
Checked against the browser threat feeds available to this scan — no hit.
What we observed
Visual context from the captured page
Chat free. Stay anonymous.
What the captured page showed
1 observation- 01
Chat free. Stay anonymous.
What the page says about itself
Quoted from the pages we read: the site's own words, not our findings.
- Page title
Free Anonymous Chat – Private & Encrypted | Murmelt
- Meta description
Murmelt is a free, anonymous chat app with end-to-end encryption. No registration, phone number or email required. Powered by Nostr.
Pages we read
- Main page/Read
- Terms/terms-of-useRead
03 · Investigation Story
Investigation story
What the site claims
Free Anonymous Chat – Private & Encrypted | Murmelt
What we observed
The page content was captured and checked alongside 57 antivirus results.
What independent research found
The search completed without a material external warning or corroborating report.
What remains unverified
1 of the 6 applicable core capabilities did not complete, so those gaps remain visible in the coverage ledger.
What kind of site and risk is this?
Threat category
No threat category confirmed
Service and business model
Saas
Observed behavior
Evidence behind this classification
- 01The registrable domain is only 86 days old, so there is little history to judge the operator by.
- 02Safe Browsing returned no threat warning, the TLS connection is valid, and the hosting IP has zero abuse reports.
- 03The site publishes a contact mailbox on its own domain, info@murmelt.com.
Web research findings
Independent findings for murmelt.com, including public complaints, named review sources, registration records, and look-alike-domain evidence.
No independently sourced scam reports or credibility records were found for murmelt.com. That is common for new or low-traffic sites and does not clear the site.
Reputation Sources
How this domain rates across independent threat-intelligence and blocklist providers.
04 · Domain & Infrastructure
Domain & infrastructure
The plumbing behind the site — who registered it, how it’s encrypted, where it’s hosted, and where it links out. A valid certificate or a calm server doesn’t mean the business is honest — scam sites pass these checks too.
Infrastructure map
- Domainmurmelt.com
- Redirects towww.murmelt.com
- Hosted byHOSTKEY B.V.
Domain Timeline
- Aug 11, 2026Domain registered
First appeared in WHOIS records — 86 days old when this review was saved.
- Nov 5, 2026Saved security review — Rated Low Risk
This saved scan found no material threat, but the evidence was not strong enough for the highest Safe tier.
Contact Verification
Saved contact details can help identify the operator. Their presence supports traceability; it does not prove the business is trustworthy.
- Contact email on the site's own domain (info@murmelt.com).
Domain & Encryption
A certificate issued weeks or days before the scan on a domain registered recently is common on short-lived sites, though new legitimate sites look the same.
Certificate issued for www.murmelt.com.
Payment providers the page loads
None seen among the outside domains we saved.
Read from the first 20 outside domains the page loads and the shop platform it uses; the web server and platform rows are under Hosting & Technology. A payment script on the page does not prove the shop accepts that method at checkout, or that you are protected.
Redirect Chain
- 1301http://murmelt.com/
- 2200https://www.murmelt.com/
Server Reputation
05 · Evidence Ledger
Evidence ledger
- Antiviruspartial
- Browser threat feedcomplete
- Page contentcomplete
- Analysiscomplete
- Visual evidencecomplete
The conclusion is supported by the evidence saved with this report.
Technical threat
unknownMalware, phishing, credential theft and hostile infrastructure.
No confirmed evidence in this dimension.
Operator / customer risk
suspiciousComplaints, withdrawals, business conduct and commercial traps.
The site names no company, address or individual behind the client, describing itself only as browser software that is not a service provider. · The registrable domain is only 86 days old, so there is little history to judge the operator by.
Source coverage and freshness
Status shows whether usable evidence was saved; finding shows what that evidence observed.
| Source | Result | Completion | Finding | Freshness |
|---|---|---|---|---|
| Antivirus | 0 of 91 engines flagged | Limited | No saved finding | stale fallback · analysed Sep 11, 2026 |
| Browser protection | No browser threat-list match | Completed | No adverse finding | this scan · Nov 5, 2026 |
| Page content | Page fetched · HTTP 200 | Completed | No adverse finding | this scan · Nov 5, 2026 |
| Visual evidence | 1 visible observation saved with the page capture | Completed | No adverse finding | this scan · Nov 5, 2026 |
| Independent research | The search completed without a material external finding | Completed | No adverse finding | this scan · Nov 5, 2026 |
- Antivirus
- Result0 of 91 engines flagged
- CompletionLimitedFindingNo saved finding
- Freshnessstale fallback · analysed Sep 11, 2026
- Browser protection
- ResultNo browser threat-list match
- CompletionCompletedFindingNo adverse finding
- Freshnessthis scan · Nov 5, 2026
- Page content
- ResultPage fetched · HTTP 200
- CompletionCompletedFindingNo adverse finding
- Freshnessthis scan · Nov 5, 2026
- Visual evidence
- Result1 visible observation saved with the page capture
- CompletionCompletedFindingNo adverse finding
- Freshnessthis scan · Nov 5, 2026
- Independent research
- ResultThe search completed without a material external finding
- CompletionCompletedFindingNo adverse finding
- Freshnessthis scan · Nov 5, 2026
07 · Safety FAQ
Safety FAQ
Answered from the saved verdict and evidence in this report.
Is murmelt.com a scam or is it safe?
Is murmelt.com safe to use?
Has murmelt.com been flagged by antivirus engines?
Is murmelt.com on any phishing or malware blacklists?
How old is the murmelt.com domain?
Does murmelt.com have a valid SSL certificate?
Where is murmelt.com hosted?
How often is the murmelt.com report updated?
08 · Final Verdict
Final verdict
Murmelt is a browser-based Nostr chat client with no detected threats, but it is a 86-day-old domain run by an undisclosed operator.
Murmelt describes itself as a client application that runs in the browser and connects to third-party Nostr relays for messaging, with file attachments going to third-party Blossom servers. Our checks found no malware, phishing or payment fraud mechanics: Safe Browsing returned no warning, the TLS connection is valid, and the hosting IP has no abuse reports. The score reflects the thin track record rather than any observed attack — the domain is only 86 days old, the people behind it are not named, and the site's own terms disclaim all responsibility for what happens on the relays it connects to.
09 · Community
Community
Are you the owner of murmelt.com?Verify and reply