Is pay-bnb-wallet.vercel.app a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This site is a subdomain on a public application-hosting platform. Its name suggests a payment or wallet service for the BNB cryptocurrency ecosystem. At capture, the homepage returned only a "404: NOT_FOUND" error page with a very small amount of text. No product, brand, operator or service description was visible, so its apparent purpose is inferred from the domain name and not from anything the site states.

Scam/Impersonation Risk

This is a high-risk, cautionary finding. The multi-engine reputation scan returned a substantial number of malicious detections, including from several tier-one security vendors, and it also returned suspicious detections. This is a confirmed blacklist condition and the decisive factor in the assessment. Reputation data also links the domain to known phishing activity. The name pairs "pay", "bnb" and "wallet" on a free platform subdomain. That is a pattern commonly used to attract people looking for cryptocurrency payment or wallet access, and it suggests the site may be posing as a payment or wallet service. No brand impersonation or conflicting legal identities were confirmed, because the site shows no content that could be compared. Behavioral testing found a strong cloaking pattern. The page content changed materially after simulated interaction, so what a scanner or first-time visitor sees may differ from what is later presented. A clipboard write was also detected during testing. In a wallet-themed context, a clipboard write is a recognised technique for swapping a copied payment address. This test alone does not prove that is happening here. Browser traffic was almost entirely directed to external hosts, although none of those hosts were non-whitelisted. Abuse reports exist against a hosting address the site shares. Those reports belong to the shared platform and are discounted, so they do not count against this site. Evidence:

• Homepage, multi-engine reputation scan: 13 malicious and 2 suspicious detections, including Fortinet, Kaspersky and Sophos.
• Behavioral testing of the homepage: strong cloaking (semantic difference 9.86, visual difference 7.84 after interaction); clipboard write detected; 70 external XHR requests and 12 external POSTs across 3 runs.
• Shared hosting address 64.29.17.3: 81 abuse reports, confidence score 0, classed as shared infrastructure and discounted.
• Homepage capture: HTTP 404 with a "404: NOT_FOUND" title and about 198 characters of text.

Regulatory Verification Notes

The captured page has no legal, terms, privacy, about or contact content. It names no operating company, registration number or licence, so the site's real-world operator is not independently verified. That fits the pattern of a payment or wallet-themed service that handles value without any disclosed regulatory standing. This gap is a verification matter and not proof of fraud by itself, but it gives no mitigation against the confirmed reputational findings. No third-party broker or regulatory-database match was found. Absence from such a database is not a regulatory verdict. The valid certificate is domain-validated only. It confirms an encrypted connection and says nothing about who operates the site. Evidence:

• Homepage: no company name, licence, terms or privacy content on the captured page.
• Transport encryption: TLS certificate issued by WR1 (DV), valid to 2026-11-27, with 36 days remaining.
• Hosting infrastructure: served from AS16509 (AMAZON-02 - Amazon.com, Inc., US).

What to Verify Next

Nobody should enter credentials, connect a wallet, or send funds here. Any claim that this site is an official BNB-related payment or wallet service should be checked against the official channels of the brand it appears to reference. Those channels should be reached by typing their known addresses directly, not through links or messages that led to this site. If the site is part of a legitimate project, the operator should publish identifying and licensing information and should confirm the status of the security-vendor detections through the vendors' own review processes. Confirm any official support or contact channels independently and offline. Evidence:

• Homepage: no brand, operator or service description is available to check against.
• Reputation scan: detections from several vendors, which a legitimate operator can contest through those vendors.
• Behavioral testing: content changed after interaction, so a single visit does not show what the site actually serves.

Summary Verdict

The authoritative assessment is critical, with elevated risk. The confirmed multi-vendor detections, the cloaking behavior, the phishing association and the absence of any verifiable identity outweigh the technically valid encryption and conventional hosting. The site should be treated as hostile until proven otherwise.

Infrastructure Integrity

The site is served through a major cloud and edge platform. Its observed addresses all sit on that provider's network and belong to edge servers. The origin server was not observable, so independent verification of the hosting and the detection of rapid content changes are limited. This protective infrastructure and the valid certificate are mitigating factors only. They do not offset the reputational findings, and a free subdomain on a shared platform is an environment anyone can use. Evidence:

• Edge addresses 216.198.79.195, 216.198.79.3, 216.198.79.67 and 64.29.17.195, all within AS16509; no origin address candidates observed.

Closing Assessment

Read-only viewing is the most that is advisable. Logins, credential entry, wallet connections and financial transactions should be avoided, and nothing should be downloaded or copied from the site.

Signals weighed against the site

• AbuseIPDB: 81 reports on hosting IP 64.29.17.3 (Vercel, Inc, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.