Is sendbscusdtbnb.vercel.app a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This site is a subdomain on a public application-hosting platform. Its hostname refers to sending USDT and BNB on the BNB Smart Chain. When visited, it shows only a "Deployment Unavailable" notice with a request identifier, and no navigation, products, forms, pricing or stated business model. Its purpose cannot be determined from the page, and the hostname is the only indication of an intended use.

Scam/Impersonation Risk

Contradictory signals are present, and this is the decisive part of the assessment. The domain is blacklisted: a substantial cluster of security engines, including several tier-one vendors, classify it as malicious, and a separate external blacklist confirms the listing. The detection volume is high enough to trigger an automatic ceiling on trust that infrastructure quality cannot offset. The hostname describes a stablecoin and native-token transfer flow, which is the pattern commonly used to lure visitors into sending funds or approving wallet transactions. This is an inference from the name and the detections, because the captured page contains no transfer interface. A brand-similarity indicator also links the page to the hosting platform's own unavailability notice. It is not a confirmed impersonation, and no conflicting legal identities were found. A large volume of abuse reports exists against the serving IP address. Those reports are discounted because the address belongs to a shared platform pool serving many unrelated tenants, so they are not attributed to this site. The blacklist and malicious-engine detections stand independently of that discounted signal. The page ran three behavioral sandbox sessions with no external network calls, hidden forms, cloaking, wallet-connection attempts or clipboard manipulation. That shows the captured state is inert. It does not show the deployment is benign, because content can change once a deployment is restored. Evidence:

• Homepage: a bare "Deployment Unavailable" notice with a request identifier, a platform response consistent with a disabled or blocked deployment (the capture returned an HTTP 451 status).
• Domain provenance: roughly 15 days of observed registration continuity (~0.04 years), with a single web-archive snapshot dated 2026-10-03 (1 year tracked).
• Hostname: references BSC, USDT and BNB, a fund-transfer lure pattern, while the page itself shows no transfer functionality.
• Behavioral sandbox: three successful runs with zero external requests and no wallet or form activity.

Regulatory Verification Notes

The only page available contains no legal, corporate, licensing or contact content, so no operator, registered entity or regulator is named anywhere on the site. Real-world identity is unverified, and ownership and governance opacity are present. This is a limitation of the content, not by itself evidence of fraud. The site does not claim a license, so there is nothing to validate. The business is not presenting itself as regulated, and no third-party broker-reputation entry matches it. The only supporting technical facts are a valid but low-assurance transport certificate and mainstream hosting. Neither establishes who operates the site. Evidence:

• Homepage: no company name, registration number, license claim, terms or privacy page, and no contact channel.
• Hosting: served from AS16509 (AMAZON-02, Amazon.com, Inc., US).
• Transport encryption: TLS certificate issued by WR1 (DV, domain validation only), valid to 2026-11-27 with 39 days remaining.
• Broker-reputation dataset: no match for this domain.

What to Verify Next

Verification should focus on whether the owner is a victim or an actor, and on the origin of any link that led to this address. Anyone who received this address in a message, advertisement or social post should trace that source and treat it as suspect until proven otherwise. An organization expecting a legitimate transfer or payment service should obtain the official domain from the provider through an independent, offline route and compare it character by character against this hostname. Security teams should check blocklists, proxy logs and email gateways for traffic to the domain. They should also re-scan it periodically, because a restored deployment could serve very different content from the current error page. A legitimate operator would need to publish a verifiable legal entity and, if offering financial services, licensing details that can be confirmed with the relevant registry. Evidence:

• Homepage: no operator, licensing or contact details exist to check, so any identity claim must come from outside the site.
• Threat-intelligence listings: the domain is currently flagged by multiple independent sources, so any past or future outbound link should be treated as untrusted.
• Archive history: only a single capture exists, so there is no earlier benign content to compare against.

Summary Verdict

The site is classified at the lowest trust tier, with a cautionary, security-forward posture. Confirmed malicious detections and an external blacklist listing outweigh every mitigating technical signal. The page is currently an empty error shell, so the listing, not any visible content, drives the verdict. The operator remains unidentified and the domain is very new.

Infrastructure Integrity

The site runs on Amazon-operated infrastructure behind a recognized CDN/WAF platform, with all observed addresses being edge servers and a valid certificate in place. The origin server was not observable. These are mitigating factors only and say nothing about the operator's legitimacy. Edge-only visibility prevents independent hosting verification and allows content to be swapped rapidly behind the same address, which matters for a domain already carrying malicious detections. The shared nature of the platform's address pool also means the address's reputation is not specific to this tenant.

Closing Assessment

The site should not be used for login, credential entry, wallet connection, token approval or any transfer of funds. Interaction should be limited to passive observation from a controlled environment. Links pointing to this address should be blocked or reported to the hosting platform and the sender's channel.

Signals weighed against the site

• AbuseIPDB: 86 reports on hosting IP 64.29.17.195 (Vercel, Inc, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.