Is send-usd6.netlify.app a scam? TrustSniffer's high-risk assessment: 0/100

Overview

This is a site hosted on a free subdomain of a public static-site hosting platform. Its name suggests a USD transfer or payment service. The root page returned a "Site not found" response with only a few hundred characters of text, so no product, brand or service description was visible. Behavioural testing nonetheless found concealed form elements and password-entry fields beneath that placeholder. The apparent purpose is a credential or payment-collection front end whose commercial purpose and operator are not stated anywhere on the site.

Scam/Impersonation Risk

This is a high-risk, elevated-concern site. Its reputation checks include a confirmed blacklist listing, which is the decisive negative signal. Separately, automated browsing runs on the homepage found three concealed forms and three password-entry fields, and the same pattern appeared in every run. A page that shows a "not found" message while carrying hidden credential inputs is a recognised pattern for staged or swapped-in capture pages. The page rebuilt itself heavily after simulated interaction, which indicates content injected dynamically rather than a static document. Nearly all network traffic went to external destinations, though all of it went to recognised, whitelisted services. No wallet-connection, clipboard-hijacking or fingerprinting behaviour was observed. No conflicting legal identities or brand impersonation were found, so this assessment rests on the listing and the behaviour. Two abuse reports exist against a shared cloud address used by this site. They are attributed to the shared provider infrastructure and are heavily discounted, so they are not weighed against the site itself. The name "send-usd6" on a shared platform subdomain gives no assurance of brand ownership. Evidence:

• Homepage: three hidden forms and three password fields detected across all three test runs.
• Homepage: about 4,100 page mutations after interaction, with a not-found title on the initial capture.
• Reputation checks: one engine rated the site malicious and two rated it suspicious, alongside an external blacklist listing.
• Abuse reports: two, on a shared CDN address, discounted as shared infrastructure.

Regulatory Verification Notes

The site presents no legal, terms, about or licensing pages. The root page contains no company name, registration number, regulator reference or contact details, so no financial-services authorisation can be linked to it. Third-party broker-reputation data holds no entry for it, which is neutral and not a verdict. The real-world operator has not been independently established. The valid organisation-validated certificate names the hosting platform's operator and not the site's own operator, so it only shows that the platform terminates transport encryption. Evidence:

• Homepage: no legal entity, licence or regulator disclosure visible.
• Hosted on AS16509 (AMAZON-02, Amazon.com, Inc., US).
• TLS certificate issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 (OV), subject organisation Netlify, Inc, valid to 2027-03-19.

What to Verify Next

Any party that was directed to this address should confirm, through an independent route, who sent the link and whether a financial service of that name exists. Any claimed provider should be matched against the relevant financial-services registry, using contact details taken from the provider's own verified channels. The hosting platform's abuse desk can be asked whether the deployment is under review. Anyone who has already entered credentials or payment details should treat them as exposed. Evidence:

• Homepage: no operator identity to cross-check against a registry.
• Homepage: password fields present beneath a not-found page.
• Reputation checks: an active blacklist listing on the domain.

Summary Verdict

The overall posture is high risk. A confirmed blacklist listing and concealed credential-capture behaviour outweigh the technically sound transport security. The operator cannot be linked to any legitimate, accountable business, and the evidence is consistent with a staged or deceptive deployment.

Infrastructure Integrity

The site is delivered through Amazon's cloud and CDN edge network, and all four observed addresses are edge addresses, so the origin server is not observable. A valid certificate and mainstream infrastructure are mitigating factors only. They do not offset the reputational and behavioural concerns, and edge-only visibility makes content swaps harder to detect.

Closing Assessment

Do not log in, enter credentials, or make or authorise any payment through this site. At most, treat it as read-only. If it arrived through a message or advertisement, the sender should be challenged and the link reported to the hosting platform.

Signals weighed against the site

• AbuseIPDB: 2 reports on hosting IP 2a05:d014:58f:6200::259 (Amazon Data Services Ireland Ltd, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.