Is darkcarderdrainer.netlify.app a scam? TrustSniffer's high-risk assessment: 5/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This is a minimal single-page website on a free Netlify-hosted subdomain. Its title is "Transfer Trust Wallet", and it shows only a very short block of text, so its function is not clearly described. The title frames it around cryptocurrency wallet transfers, but the page names no operator, product, or service terms. The apparent purpose is a wallet-transfer lure or tool of undetermined legitimacy, not a recognizable commercial business.

Scam/Impersonation Risk

The site has confirmed contradictory signals. It is currently blacklisted by external threat-intelligence sources. A substantial number of security engines classify it as malicious, including several tier-one vendors, and the reputation result alone is decisive. The hostname contains the terms "carder" and "drainer", which are widely associated with payment-card fraud and wallet-draining tooling. Together with a homepage title that invites a "transfer" of wallet assets, this makes the site's apparent theme consistent with the detections rather than with a benign service. No conflicting legal identities were observed, and the evidence does not by itself establish what the page does to a visitor. Two abuse reports exist against an address in the shared cloud edge network serving the site. They relate to shared provider infrastructure rather than to this site specifically, so they are discounted. Automated behavioral testing produced no outbound data transmission, wallet-connection prompts, clipboard manipulation, hidden forms, or cloaking. This is a mitigating observation about the page as captured, but the capture contained very little content, so it cannot offset the reputational findings. Evidence:

• Homepage: titled "Transfer Trust Wallet" with only a few lines of text and no description of the service, operator, or terms.
• Hostname: contains the terms "carder" and "drainer", which are fraud-associated terminology.
• Behavioral testing of the homepage: three successful runs, no external requests, no wallet-provider activity, no clipboard writes, and no console errors.
• Abuse reports: two reports tied to a shared cloud edge IP address, attributed to provider infrastructure and discounted.

Regulatory Verification Notes

The page identifies no legal entity, registered address, license, or regulatory registration. Its stated activity, wallet transfers, would normally call for such disclosures. Ownership is opaque because the page names no operator, and the identity of whoever runs it is not independently established. This is a disclosure gap and not, on its own, evidence of wrongdoing, but here it coexists with confirmed threat detections. No broker-reputation entry was matched, so no third-party regulatory or broker signal either supports or contradicts the site. The transport-encryption certificate is valid, but it is an organization-validated certificate issued to the hosting platform, not to the site's operator. It therefore says nothing about who runs the page. Evidence:

• Homepage: no company name, license number, or registration details, and no legal or terms pages observable.
• Served from AS16509 (AMAZON-02, Amazon.com, Inc., US).
• TLS certificate issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 (OV), subject organization Netlify, Inc, valid to 2027-03-19.
• No broker or regulator record matched for the domain.

What to Verify Next

Verification here should focus on the page's origin and the operator's real-world identity, not on seeking reassurance. Establish through an independent route how the link was received, since the page offers no verifiable operator. If an operator claims to be a regulated wallet or exchange provider, confirm that claim directly with the named company through its officially published channels and with the relevant financial registry. Do not rely on anything stated on the page itself. Anyone who has already interacted with the page should check connected-wallet permissions and revoke any granted approvals. Evidence:

• Homepage: no named operator or provider whose claims could be checked.
• Homepage title: refers to wallet transfers, so any prior wallet interaction is the relevant exposure point.
• The unresolved external detections remain current at the time of analysis.

Summary Verdict

The overall posture is high-risk. External threat intelligence has decisively flagged the site, and nothing on the page offsets that finding or establishes who operates it. The fraud-associated hostname, the wallet-transfer framing, and the absence of any identifying content point the same way, and the clean sandbox behavior does not change the conclusion.

Infrastructure Integrity

The site is served from Amazon cloud edge infrastructure on a free Netlify-hosted subdomain, behind a content delivery layer. All four observed addresses are edge nodes, and the origin server was not observable. This is mitigating only. Edge-only visibility prevents independent confirmation of where the content actually lives and allows page content to be swapped quickly, so the protective infrastructure does not lessen the reputational risk.

Closing Assessment

The site should not be used for login, credential entry, wallet connection, seed-phrase entry, or any financial transaction, and nothing should be downloaded from it. Passive viewing is the only reasonable interaction, and any link that led here should be treated as untrusted and reported.

Signals weighed against the site

• AbuseIPDB: 2 reports on hosting IP 2a05:d014:58f:6200::259 (Amazon Data Services Ireland Ltd, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.