Is erc20trades.online a scam? TrustSniffer's high-risk assessment: 24/100

Security Alert

Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a minimal single-page site titled "Send USDT". Its domain name evokes ERC-20 token trading. The homepage carries only a few sentences of text and presents itself as a front for sending or trading USDT stablecoin tokens. No detailed company profile, product catalogue, or service description accompanies it, so the apparent purpose is a crypto-asset transfer or trading entry point whose operator is not identified on the page.

Scam/Impersonation Risk

The most significant finding is a confirmed external blacklist hit. A tier-one security vendor classifies the site as malicious, and a second detection flags it as suspicious. The reputational concern is therefore concrete. Because the site invites the transfer of a digital asset that cannot be recovered once sent, a reputation listing on this kind of page carries heavy weight. The domain was also registered only a few months ago, and its web-archive footprint is a single capture. That is the profile of a freshly deployed asset with no track record. No conflicting legal identities were observed and no specific brand impersonation was confirmed. The risk rests on the external detections combined with the site's newness and sparse content, not on a contradiction between identity pages. Behavioural testing showed no wallet-connection prompts, no hidden forms, no clipboard manipulation, no credential posts to third parties, and no cloaking. Those results do not offset the reputation listing, because a clean sandbox run does not rule out later changes or off-page fraud mechanics. Evidence:

• Homepage: the title and about 250 characters of text describe only a "Send USDT" function. No named operator, product terms, or fee schedule appear.
• Domain registered on 2026-06-03 (~0.38 years old, about 140 days).
• Web archive holds 1 snapshot, in 2026 (1 year tracked, first and last capture 2026-10-10).
• Reputation checks: one malicious and one suspicious detection, with an external blacklist flag set. Behavioural runs (3 of 3 successful) showed no wallet-drainer, clipboard-hijack, or external credential-post activity.

Regulatory Verification Notes

The homepage discloses no legal entity, licence, registration number, or jurisdiction. For a site inviting stablecoin transfers, that omission is notable, though by itself it is a transparency gap and not proof of fraud. Ownership is opaque: registrant details are hidden or incomplete, and the domain was registered through Namecheap. On-page identity could not be independently tied to any real-world brand or person. No third-party regulatory or broker record was matched, and the site is not recognised in public DeFi protocol directories. The overall legitimacy picture is therefore unsupported by any independent corroboration. Valid transport encryption and a stable HTTP response are the only positive technical signals. These are baseline hygiene that scam sites routinely have too. Evidence:

• Homepage: no company name, licence, registration number, or contact-identity block is disclosed.
• Hosting: served from AS399486 (VIRTUO - 12651980 CANADA INC., CA), IP geolocated to Bulgaria.
• Transport encryption: TLS certificate issued by YE2 (domain-validated only), valid to 2026-12-12 (about 51 days remaining).
• Domain registration runs 2026-06-03 to 2027-06-03 (a one-year term). Not recognised in the DeFiLlama protocol directory.

What to Verify Next

No action is needed to reach a decision, since the elevated risk assessment already stands on the evidence. Any party that still considers engaging should establish who operates the service. That means finding a named legal entity and checking it against the financial-services or virtual-asset registry of the jurisdiction in which it claims to operate. Any wallet address presented for deposits should be confirmed through an independent, offline channel with a known counterparty, and not through the page itself. The blacklist listing should be re-checked directly with the flagging security sources to see whether it is current or has been remediated. Evidence:

• Homepage: no identifiable operator, so the registry check cannot start from on-site information.
• External reputation: the listing is active at the time of analysis, so the re-check is pertinent.
• Registration is under a one-year term from June 2026, so ownership or content changes may follow quickly.

Summary Verdict

The assessment is an elevated-risk posture. The site is a newly created, thinly documented crypto-transfer page with an active external blacklist listing and no independent corroboration of who runs it. Nothing in the available evidence supports treating it as a legitimate venue for asset movement or account access at this time.

Infrastructure Integrity

The site resolves to a single IP address at a commodity data-center hosting provider. No CDN or WAF was detected in front of it, so there is no protective layer to mitigate exposure. The infrastructure is functional and stable, but it does not offset the reputation risk. The network heuristic pointing to fragmentation is unconfirmed and carries no weight in this assessment.

Closing Assessment

The site is suitable at most for read-only viewing. Account login, credential entry, wallet connection, and any transfer of funds or tokens should be avoided until the operator is independently identified and the external listing is cleared.