Is newtrustcard.vercel.app a scam? TrustSniffer's high-risk assessment: 5/100

Security Alert

Fortinet flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a subdomain on a shared application-hosting platform's public namespace. A visitor reaches only a bare placeholder page titled "Temporary Error", with about two sentences of text and no products, navigation, company description, or legal pages. Its apparent purpose and business model cannot be determined from what it presents. Its trust-themed, card-related hostname suggests a possible payment or security service, but the page does not say so.

Scam/Impersonation Risk

The site has confirmed contradictory signals. Several independent security engines currently flag it as malicious or suspicious, and it is blacklisted on external threat lists. The detections do not specify a threat category, so the evidence supports a confirmed adverse reputation but not a named attack type. No phishing, brand-impersonation, or conflicting legal-identity findings were recorded. A cluster of abuse reports does exist against one of the site's serving addresses. That address belongs to the provider's shared, multi-tenant delivery network, and the reports carry no confidence against this site, so they are discounted and not counted against it. The decisive concern is the combination of an adverse external reputation, a hostname that is only days old, and a placeholder page that discloses nothing, since this pattern is typical of disposable infrastructure staged ahead of later content. The capture also resolved under a different subdomain name than the one requested, which points to redirection or content that can change after review. The page showed no cloaking, no hidden forms, and no wallet or credential-capture behavior in the sandbox runs, but that only describes a nearly empty page and does not clear the site. Evidence:

• Homepage: a placeholder error page with minimal text, with no stated service, operator, or contact route.
• Homepage capture: the page was served under a different subdomain name than the one analysed, a hostname inconsistency.
• Domain provenance: registration continuity of about one day; web archive holds only 3 snapshots, all from 2026 (1 year tracked).
• Sandbox behavior: 3 of 3 runs succeeded, with no external requests, no password forms, and no wallet or clipboard activity.

Regulatory Verification Notes

The site exposes no terms, privacy policy, about page, company name, licence, or registration number, so there is nothing to assess against a regulatory framework. Ownership and governance are opaque, and the real-world operator is not independently connected to any person or brand. Nothing in the evidence suggests the site is a regulated or authorised entity. No third-party broker or regulatory-review record matched the site, so no reputational signal of that kind exists either way. Because the site has no content, its transport security says nothing about legitimacy. A valid certificate shows only that the connection is encrypted. Evidence:

• Hosting: served from AS16509 (AMAZON-02, Amazon.com, Inc., US).
• Transport encryption: TLS certificate issued by WR1 (DV, domain validation only), valid to 2026-11-27.
• Homepage: no legal, licensing, or corporate-identity disclosures of any kind.

What to Verify Next

Anyone who reached this address through a message, advertisement, or QR code should confirm the exact hostname and the sender's authenticity through a separate, independent channel. Any claimed brand or service should be confirmed through its officially published channels, which should be found independently and not through this address. If the operator claims to offer a regulated financial or card-related service, the claim should be checked against the relevant public regulator register before any engagement. A later re-assessment is worthwhile once the placeholder is replaced with real content, because the current reputation and content may change. Evidence:

• Homepage: no operator name or service description to cross-check.
• External reputation: current adverse flags remain unresolved and would need to clear before the site is reconsidered.

Summary Verdict

The overall posture is one of elevated risk. A confirmed adverse external reputation, a very recently established hostname, and an uninformative placeholder page converge on a site that should be treated as untrusted. Benign behavior in testing and a valid certificate do not offset these signals.

Infrastructure Integrity

The site is delivered through a trusted content-delivery and web-protection network. All six observed addresses are edge servers, and the origin server was not observable. This reduces exposure to direct attack and reflects mainstream hosting, but it is only a mitigating factor. It also prevents independent verification of the true host, and content behind the edge can be swapped quickly. It cannot offset the reputation risk.

Closing Assessment

Account login, credential entry, and any payment or financial interaction should be avoided entirely. At most, the site should be viewed passively from a protected, isolated browser environment, and no file should be downloaded from it.

Signals weighed against the site

• AbuseIPDB: 85 reports on hosting IP 216.198.79.3 (Vercel, Inc, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.