Verdict
This assessment found strong scam indicators. Do not pay, sign in, or share personal details with this site.
click-tow-transfer.vercel.app shows high-risk / scam indicators.
Evidence status and limitations
Evidence completeness: Not recorded
- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.
At a glance
The checks that decide most of this verdict.
| Malware engines | 16 flagged itVirusTotal | Risk |
|---|---|---|
| Google Safe Browsing | Not listedGoogle | Clear |
| Abuse reports on the host | 0% confidenceAbuseIPDB, 93 reports; shared hosting inflates reports | Clear |
| Domain age | Not availableNo registration record was returned | Noted |
| Certificate | Encrypted connectionIssued by WR1 | Noted |
| Hosted by | AMAZON-02Server in US | Noted |
The page as captured
Key findings
- Automated classification: Sensitive Interaction Risk.
- At least one reputation service TrustSniffer consulted had flagged this domain at assessment time.
Full analysis
Security Alert
Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.
This is a single-page website on a free, platform-issued Vercel subdomain, titled "Transfer Trust Wallet". The homepage shows only a very small amount of visible text and no detailed product, pricing, or company narrative. The name and title suggest a cryptocurrency wallet-transfer or wallet-servicing page. The page does not state a clear business model, and the operator's real-world identity is not independently verified.
Scam/Impersonation Risk
The site is blacklisted. Several independent security engines currently classify it as malicious, including three tier-one security vendors, and this is the decisive factor in the assessment. The site was not found to have conflicting legal identities, and no confirmed brand-impersonation finding is recorded. However, a page named after wallet transfers, on a disposable free subdomain and with almost no explanatory content, matches the profile commonly used to lure visitors into wallet-related actions. A blacklisting of this strength should not be discounted because the page looks sparse or technically tidy. In the automated browser sessions the page made no outbound data requests. It also triggered no wallet-connection prompts, clipboard manipulation, hidden forms, or cloaking. That is a mitigating observation about what was seen on the sampled page. It does not offset the external threat detections, because malicious behaviour can be switched on later or shown only to certain visitors.
- Homepage: titled "Transfer Trust Wallet", with a very small amount of visible text and no product, pricing, or company description.
- External reputation: 16 malicious and 1 suspicious detections, including three tier-one security vendors, which establishes the blacklisting.
- Behavioural testing of the homepage: three successful runs with no external requests, no wallet-provider interaction, and no clipboard or form anomalies.
Regulatory Verification Notes
The homepage discloses no company name, licence, registration number, or legal pages. It gives no way to connect the service to a real, accountable entity. Because the site sits on a platform-issued subdomain rather than its own registered domain, there is also no standalone domain identity to anchor it. Nothing indicates it is regulated or supervised as a financial or wallet service. No third-party broker-reputation record matched the site, and that is neutral context rather than a verdict. The licensing and disclosure gaps are a verification matter. The serious concern comes from the threat detections described above, not from the missing disclosures.
- Homepage: no operator name, licence, or registration details, and no terms, privacy, or about content.
- Hosting infrastructure: served from AS16509 (AMAZON-02, Amazon.com, Inc., US).
- Transport encryption: TLS certificate issued by WR1 (DV, domain validation only), valid to 2026-11-27. This confirms encrypted transport but says nothing about who operates the site.
What to Verify Next
Anyone who received a link to this page, especially through a message, social post, or advertisement claiming to relate to a wallet, should check its legitimacy through the wallet provider's own official website or app, not through this page. No seed phrase, wallet connection, or transaction approval should be offered to the site while it carries these detections. The hosting platform's abuse channel can confirm whether the deployment has been reviewed or removed. Any contact or support channel the site presents should be confirmed independently, by an offline or officially published route.
- Homepage: a wallet-transfer title with no verifiable link to a named provider.
- External reputation: the detections are current and come from several independent engines, so a later re-check is needed to see whether the listing has been cleared.
- Hosting platform: the deployment sits on a shared subdomain, so the platform operator can act on abuse reports.
Summary Verdict
The overall posture is high risk. Current third-party threat detections dominate the assessment. The technical hygiene and clean sandbox behaviour are insufficient to offset them. The site's identity is unverified, so it cannot be treated as a legitimate or accountable service.
Infrastructure Integrity
The site is delivered through Vercel's edge network on Amazon-hosted infrastructure. All observed addresses are edge servers, and the origin server was not observable. This is a mitigating factor for hosting stability, but it prevents independent verification of where the content is actually served from. Protective infrastructure is not evidence of legitimacy. A large number of abuse reports exist against one of the shared edge addresses. These apply to the provider's multi-tenant network rather than to this site specifically, so they were discounted and are not treated as a finding against it.
Closing Assessment
The site should not be used for login, credential entry, wallet connection, or any financial transfer. Visitors should avoid engaging with it until the external detections are cleared and a named, accountable operator can be confirmed independently. Anyone who has already interacted with it should treat any wallet, credentials, or approvals they exposed as potentially compromised.
Written analysis generated 2026-10-26 by the TrustSniffer Analysis Engine from the evidence in this report.
What the analysis found
3 findings contributed to this verdict, raised by governance, external reputation, registration and ownership.
01 Governance
- A threat feed lists this domain as malicious, and that caps the score whatever the other checks found.Governance
rule:GOV_CRITICAL_BLACKLIST
02 External reputation
- An external threat feed lists this domain: either Google Safe Browsing marked it malicious, or a significant number of malware engines flagged it.External reputation
rule:EXT_BLACKLIST_CRITICAL
03 Registration and ownership
- The public registration record for this domain is incomplete.Registration and ownership
rule:KF_WHOIS_INCOMPLETE
Signals weighed against the site
- AbuseIPDB: 93 reports on hosting IP 216.198.79.131 (Vercel, Inc, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.
Identity verification
| Status | UNKNOWN |
|---|---|
| Identity score | 50/100 |
| Identity verification confidence | 30% |
- AI page analysis unavailable (page captured; identity not AI-verified)
Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence.
What TrustSniffer observed
First-party facts recorded during the assessment of click-tow-transfer.vercel.app.
- The request stayed on click-tow-transfer.vercel.app. It was not redirected to another domain. Clear
- It is hosted on AMAZON-02, from a server in US. Noted
Domain intelligence
| Registrar | Not available |
|---|---|
| Hosting | AMAZON-02 - Amazon.com, Inc., US |
| Country | US |
| Server IP | 216.198.79.131 |
| Name servers | Not available |
| CDN / edge network | Detected |
| Resolved IP addresses | 8 |
| Edge IP addresses | 8 |
| Likely origin IP addresses | 0 |
| SSL issuer | WR1 |
| SSL expiry | 2026-11-27 |
| Domain age | Not available (no registration date was returned) |
| Domain expiry | Not available |
| Archive first seen | Not available |
| Archive snapshots | Not counted (archive lookup incomplete) |
| Reputation | VirusTotal: 16 flagged | AbuseIPDB: 0% confidence, 93 reports | Google Safe Browsing: 0 matches |
About this assessment
A trust score summarises the evidence TrustSniffer could collect about click-tow-transfer.vercel.app at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.
TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.