Is send-usdt-1-chi.vercel.app a scam? TrustSniffer's high-risk assessment: 5/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a single-page site hosted on a shared Vercel subdomain, whose address and title ("Transfer Trust Wallet") present it as a cryptocurrency transfer tool for sending USDT. The homepage carries only a very small amount of text and appears to be a minimal front end for moving digital assets through a wallet-style flow. It shows no identifiable operator, product description, or business model beyond that implied function.

Scam/Impersonation Risk

Multiple independent security vendors currently flag this site as malicious, and a confirmed blacklist listing is in place. Several leading vendors are among those flagging it, and the volume of detections is high enough on its own to place the site in an elevated-risk category. The page's wallet-transfer framing and its stablecoin-themed address match the pattern commonly used for asset-diversion and fake-transfer lures. The branding references a recognised wallet service, but no verified connection to that service was established, and no direct brand impersonation was confirmed. No conflicting legal identities were observed. In sandbox testing the page made no outbound third-party requests, showed no wallet-drainer or clipboard-manipulation behaviour, and did not cloak its content. These results show no active exploit at the time of testing but do not offset the blacklist listing, because a wallet-themed page can change its behaviour once a visitor connects or signs a transaction. Separately, many abuse reports are recorded against a Vercel network address associated with this host. Those reports apply to infrastructure shared across many unrelated customers, so they were discounted and do not count against this site specifically. Evidence:

• Homepage: titled "Transfer Trust Wallet", with only a few dozen characters of visible text and no product, company, or support content.
• Threat-intelligence reputation: 18 malicious detections across the vendors consulted, including three leading security vendors, with zero from Google Safe Browsing.
• Sandbox behaviour: 3 of 3 runs completed with HTTP 200, zero external requests, no wallet-provider interaction, and no hidden forms.
• Abuse reporting: 91 reports against the shared Vercel address, with a confidence score of 0 and a whitelisted content-delivery classification.

Regulatory Verification Notes

The captured homepage discloses no legal entity name, licence, registration number, terms of service, or privacy policy. A tool that moves digital assets would normally disclose these items, so their absence here is a verification gap. On its own the gap is not proof of wrongdoing. It carries weight here only because it sits alongside the confirmed blacklist listing. The site's real-world operator has not been independently connected to any brand or person, so any on-page implication of an affiliation with a wallet provider carries no evidentiary weight. No third-party broker or regulator listing was matched. Because the domain is a free subdomain on a shared hosting platform rather than a purchased domain, it provides no corporate identity signal. Evidence:

• Homepage: no company name, jurisdiction, licence, or registration identifier is shown.
• Site structure: no terms, privacy, or about pages were captured.
• Hosting: served from AS16509 (AMAZON-02, Amazon.com, Inc., US).
• Transport encryption: a TLS certificate issued by WR1 (DV, domain validation only), valid to 2026-11-27, which confirms encryption but not operator identity.

What to Verify Next

Any contact with this site should be preceded by independent confirmation of whether the wallet provider named in its title actually operates it. That means checking the provider's official channels, reached by manually typed addresses rather than links from this site. If a transfer was already initiated or a wallet connected, the wallet's token approvals should be reviewed and revoked, and the transaction history checked for unexpected outflows. The site's hosting provider and the listing vendors can be asked whether the flag has been reviewed, and the official support channels of any service the site claims to represent should be confirmed through an offline route. Security teams should monitor the address for content changes, because the current status may not reflect later behaviour. Evidence:

• Homepage: wallet-transfer branding with no verifiable operator.
• Reputation record: the blacklist listing is current and unresolved.
• Sandbox results: the current page is quiet, which makes later changes harder to spot without ongoing monitoring.

Summary Verdict

The site is assessed as carrying elevated risk, driven decisively by current external threat detections and the lack of any verifiable operator. Technical hygiene such as valid encryption and quiet sandbox behaviour is real but carries little weight against a confirmed blacklist and an anonymous wallet-transfer proposition. The overall posture is clearly cautionary.

Infrastructure Integrity

The site is served from Amazon-operated address space through a recognised content-delivery and edge layer, and all observed addresses are edge nodes. The true origin server was not observable. This arrangement mitigates direct exposure of the origin, but it also prevents independent verification of the hosting and can mask rapid content swaps. Protective infrastructure is a mitigating factor only. It does not establish legitimacy and cannot offset the reputation risk.

Closing Assessment

Account login, credential entry, wallet connection, and any financial transfer through this site should be avoided. At most, the page may be viewed passively in an isolated environment, and nothing should be downloaded or signed. Anyone who has already interacted with it should treat their wallet and associated accounts as potentially exposed and act accordingly.

Signals weighed against the site

• AbuseIPDB: 91 reports on hosting IP 64.29.17.195 (Vercel, Inc, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.