Verdict
This assessment found strong scam indicators. Do not pay, sign in, or share personal details with this site.
stusdt-swap.vercel.app shows high-risk / scam indicators.
Evidence status and limitations
Evidence completeness: Not recorded
- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.
At a glance
The checks that decide most of this verdict.
| Malware engines | 15 flagged itVirusTotal | Risk |
|---|---|---|
| Google Safe Browsing | Not listedGoogle | Clear |
| Abuse reports on the host | 0% confidenceAbuseIPDB, 89 reports; shared hosting inflates reports | Clear |
| Domain age | 6 months oldMost scam domains are under a year old | Watch |
| Web archive | Archived since 20262 snapshots | Clear |
| Certificate | Encrypted connectionIssued by WR1 | Noted |
The page as captured
Key findings
- Automated classification: Sensitive Interaction Risk.
- Domain age: less than 1 year (registration continuity).
- Public web-archive history exists since 2026.
- At least one reputation service TrustSniffer consulted had flagged this domain at assessment time.
Full analysis
Security Alert
Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.
This website is a single-page decentralized-finance style application, hosted on a free subdomain of a developer deployment platform. Its title presents it as "stUSDT Swap": a service to stake USDT, earn "T-Bill yield" on the TRON network, and exchange stUSDT back into USDT. To a visitor it appears to be a token-swap and yield-staking front end. Its apparent business model is collecting user stablecoin deposits in return for advertised treasury-style returns.
Scam/Impersonation Risk
This site carries a confirmed blacklist listing. A substantial number of independent security engines currently flag the site as malicious, and several top-tier security vendors are among them. This is a decisive, corroborated negative that infrastructure quality cannot offset. The reputation of the platform's shared addresses is a separate matter. Abuse reports against one of those addresses are attributed to shared provider infrastructure, and the reports were discounted. The blacklist finding does not depend on them. The product concept adds to the concern. A stablecoin "staking" token that promises treasury-bill yield on TRON is a common lure for deposit-harvesting schemes. The page names no issuer, reserve custodian, or audit that could support the yield claim. Sandbox testing showed no wallet-drainer behavior, clipboard manipulation, hidden forms, or cloaking. The page is also young and thinly archived. Most of its network activity, including its form-style POST traffic, goes to third-party destinations outside the platform's normal allow-list. Impersonation of a specific brand was not confirmed, and no conflicting legal identities appear. The deciding factor is the active threat detections combined with a finance product that handles user funds.
- Homepage reputation check: 15 security engines rated the site malicious and 1 rated it suspicious, including three tier-one vendors. The reputation tripwire for critical detections was triggered.
- Homepage behavior: 9 external XHR/fetch calls and 9 external POST requests were observed. 6 of each went to non-whitelisted destinations, and external traffic peaked at 85.7% of requests in one run.
- Domain provenance: continuity of about 0.5 years (182 days), with only 2 archive snapshots, both captured on 2026-04-26 (1 year tracked).
- Homepage title: "Stake USDT, Earn T-Bill Yield on TRON" and "stUSDT to USDT Exchange". No named operator, reserves, or audit accompanies the claim.
Regulatory Verification Notes
No regulatory standing could be confirmed for this site. No regulator or registry source supports it, and the on-page disclosure of company identity, licensing, or registration is unclear. Operator identity could not be independently connected to a real-world person or company. Both ownership and governance are opaque. A product that offers yield-bearing stablecoin staking and exchange would ordinarily be expected to name its issuing entity and the jurisdiction that governs it. No third-party broker-reputation entry matches the site, so there is no external regulatory context either way. The site's transport encryption is a valid domain-validated certificate. It confirms only that the connection is encrypted and says nothing about who operates the site. The TRON-based token is not recognized in DeFi protocol tracking directories. The "T-bill yield" claim therefore has no independent market footprint to support it.
- Hosting: served from AS16509 (AMAZON-02, Amazon.com, Inc., US), registry ARIN.
- Transport encryption: TLS certificate issued by WR1 (DV), valid to 2026-11-27 (32 days remaining).
- DeFi directory check: no match, so no TVL or protocol recognition is available for the stUSDT product.
- Homepage: the page content was captured successfully, but it did not yield an identifiable operator or regulatory registration.
What to Verify Next
The yield claim and the operator should be assessed independently before any funds are involved. First, determine whether any legal entity claims to issue stUSDT and check that entity against the financial regulator registry in its stated jurisdiction. Second, look for the token's contract on the TRON blockchain through an independent explorer. Review its supply, holder distribution, and whether it is backed by any verifiable reserve. Third, look for the product through the official channels of any established stablecoin issuer or treasury-backed token provider. A legitimate offering would be listed there. Fourth, confirm official support and contact channels through an independent route rather than links on the page. Existing holders should stop interacting with the site until the detections are cleared.
- Homepage: the staking and exchange claims name no issuer, custodian, or auditor to check.
- Domain history: only 2 archive snapshots, both from 2026-04-26, so there is no long track record to rely on.
- Reputation check: current detections remain active, so the status should be re-checked before any reassessment.
Summary Verdict
The site is assessed as high risk. Active threat-intelligence detections are the decisive factor, and the identity of the operator is unverified. The sandbox did not observe wallet-drainer or cloaking behavior. That does not offset the confirmed detections on a site whose purpose is to take in user funds.
Infrastructure Integrity
The site is deployed on a mainstream developer hosting and edge platform. Its traffic resolves only to shared edge addresses in a major cloud provider's network. The underlying origin server was not observable. This is a mitigating factor only. It shows the site runs on reputable infrastructure, but it cannot prove the legitimacy of what is published there, and shared edge delivery makes it easy to swap content quickly. The DNS profile shows nothing unusual beyond the short-lived, ephemeral nature typical of this kind of subdomain deployment.
Closing Assessment
The site should not be used for login, wallet connection, deposits, or any financial interaction. At most, it may be viewed read-only from a protected environment. Anyone who has already interacted with it should review their wallet permissions and move funds if they suspect exposure.
Written analysis generated 2026-10-25 by the TrustSniffer Analysis Engine from the evidence in this report.
What the analysis found
5 findings contributed to this verdict, raised by governance, external reputation, history in the web archive, behaviour in a sandbox, registration and ownership.
01 Governance
- A threat feed lists this domain as malicious, and that caps the score whatever the other checks found.Governance
rule:GOV_CRITICAL_BLACKLIST
02 External reputation
- An external threat feed lists this domain: either Google Safe Browsing marked it malicious, or a significant number of malware engines flagged it.External reputation
rule:EXT_BLACKLIST_CRITICAL
03 History in the web archive
- The web archive has almost no record of this domain, which fits a site that is new.History in the web archive
rule:ARCH_PEN_YOUNG_AND_SPARSE
04 Behaviour in a sandbox
- Most of what the page loaded came from other domains rather than from this one.Behaviour in a sandbox
rule:BEHAV_EXTERNAL_RATIO_HIGH - The page exchanged network traffic with destinations TrustSniffer does not recognise.Behaviour in a sandbox
rule:BEHAV_NONWHITELISTED_TRAFFIC
05 Registration and ownership
- The public registration record for this domain is incomplete.Registration and ownership
rule:KF_WHOIS_INCOMPLETE
Signals weighed against the site
- AbuseIPDB: 89 reports on hosting IP 64.29.17.67 (Vercel, Inc, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.
Identity verification
| Status | UNKNOWN |
|---|---|
| Identity score | 50/100 |
| Identity verification confidence | 30% |
- AI page analysis unavailable (page captured; identity not AI-verified)
Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence.
What TrustSniffer observed
First-party facts recorded during the assessment of stusdt-swap.vercel.app.
- The request stayed on stusdt-swap.vercel.app. It was not redirected to another domain. Clear
- The earliest public archive of this site is from 2026-04-26. Clear
- It is hosted on AMAZON-02, from a server in US. Noted
Domain intelligence
| Registrar | Not available |
|---|---|
| Hosting | AMAZON-02 - Amazon.com, Inc., US |
| Country | US |
| Server IP | 64.29.17.67 |
| Name servers | Not available |
| CDN / edge network | Detected |
| Resolved IP addresses | 6 |
| Edge IP addresses | 6 |
| Likely origin IP addresses | 0 |
| SSL issuer | WR1 |
| SSL expiry | 2026-11-27 |
| Domain age | 0.50 years (continuous registration) |
| Domain expiry | Not available |
| Archive first seen | 2026-04-26 |
| Archive snapshots | 2 |
| Reputation | VirusTotal: 15 flagged | AbuseIPDB: 0% confidence, 89 reports | Google Safe Browsing: 0 matches |
About this assessment
A trust score summarises the evidence TrustSniffer could collect about stusdt-swap.vercel.app at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.
TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.