Is send-bep-usdt-bsc.vercel.app a scam? TrustSniffer's high-risk assessment: 1/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is an auto-generated subdomain on a public application-hosting platform. Its hostname describes sending USDT over the BEP-20 standard on the BNB Smart Chain. When reviewed, the homepage showed only a "Deployment Unavailable" placeholder with a few lines of text, and the host returned a restricted-access response. No product, brand, company or service is described, so the apparent purpose can only be inferred from the hostname, which reads like a stablecoin transfer or payment-collection page.

Scam/Impersonation Risk

The assessment rests on external threat intelligence, because the page itself exposed almost nothing to analyse. A substantial number of security engines currently flag the site as malicious, including several tier-one vendors, and it is confirmed on blacklists. This is a hard contradiction and the decisive factor in the assessment. The hostname combines an action phrase ("send"), a token standard and a named blockchain on a free, disposable subdomain. That is a common construction for crypto-transfer lures, and it also resembles the hosting platform's own domain, which adds a lookalike element. The reputation evidence does not show which scheme is involved, and sandbox testing recorded no wallet-connection, clipboard-manipulation or external form-posting behaviour. That test ran against a placeholder page, so it is weak assurance. The detections remain the controlling signal. No conflicting legal identities were observed, because the page presents no identity at all. Evidence:

• Homepage: the page title is "Deployment Unavailable" and the only content is a short placeholder message, so the page offers no verifiable business function.
• Reputation checks: multiple independent security engines classify the host as malicious, and it appears on external blacklists. A kill-switch condition was triggered by the volume of detections.
• Web archive: a single snapshot, first and last seen on 2026-09-22 (about 29 days tracked), and no earlier history for the host.
• Sandbox: three clean runs showed zero external requests and no wallet-provider activity, with three console errors, consistent with a stub page.

Regulatory Verification Notes

The only page available carries no legal entity name, licensing statement, registration number, terms or privacy policy. Operator identity could not be tied to any real-world brand or person, and ownership is opaque. For a site whose hostname implies handling digital-asset transfers, that is a significant content gap, and it compounds the reputational findings above. No third-party broker or regulatory listing matched this host, so no external reputational context exists on this point. Evidence:

• Homepage: no company name, jurisdiction, licence or contact disclosure appears.
• Transport security: the TLS certificate is issued by WR1 at domain-validation level only, valid to 2026-11-27 (36 days remaining). This confirms encryption but says nothing about the operator.
• Network origin: served from AS16509 (AMAZON-02, Amazon.com, Inc., US), registry ARIN.

What to Verify Next

No engagement should proceed on the strength of this host. Anyone who received a link to it should establish its source through an independent, offline route. They should confirm with the supposed counterparty, using previously known contact details, that the payment instructions are genuine. Any wallet address or transfer request associated with the link should be treated as unauthorised until confirmed. Organisations should re-check the reputation status after the placeholder is replaced or removed, since the content could change. Evidence:

• Homepage: no named counterparty or official channel is presented that could be used for confirmation.
• Hostname: the transfer-related wording suggests the link was likely distributed to a specific recipient, so its origin is the key fact to establish.
• Threat intelligence: detections are current as of this assessment and may change if the deployment changes.

Summary Verdict

The site carries a critical, high-risk trust posture. Strong external threat detections and confirmed blacklisting outweigh every neutral or mitigating technical signal, and no content exists that could establish legitimacy or operator identity. The site is treated as hostile, and interaction beyond passive observation is outside the safe range.

Infrastructure Integrity

The site is delivered through the hosting platform's edge network on Amazon-operated address space. It uses a valid but basic certificate, and the true origin server is not observable. This is a mitigating factor only and does not offset the reputation findings. A large number of abuse reports apply to the shared edge address. They are attributed to the platform's shared infrastructure rather than this site and were discounted, so they do not add to the risk assessment. However, the shared, disposable nature of the platform allows content to be swapped quickly, which limits independent verification.

Closing Assessment

Passive viewing is the only acceptable interaction. Logging in, entering credentials, connecting a wallet, and sending funds or tokens should all be avoided. Any link to this host should be reported to the platform's abuse team and to internal security.

Signals weighed against the site

• AbuseIPDB: 81 reports on hosting IP 64.29.17.131 (Vercel, Inc, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.