Is thailandexchange.vercel.app a scam? TrustSniffer's high-risk assessment: 1/100

Security Alert

Fortinet, Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

Thailand Exchange is a single-brand website that presents itself as a retail service for buying and selling the USDT stablecoin in Thailand. Its page title names Phuket, Bangkok and Pattaya as service locations. Its apparent purpose is to act as a local fiat-to-stablecoin conversion intermediary aimed at tourists and residents in those cities, which means visitors would be asked to hand over money or crypto to an operator they cannot otherwise identify.

Scam/Impersonation Risk

This is the dominant concern. Several independent security engines currently flag the site as malicious, including two tier-one vendors. The combined detections amount to a confirmed blacklist listing and carry decisive weight. Archive and reputation checks also associate the domain with known phishing activity. No brand impersonation and no conflicting legal identities were observed, so the risk rests on the external detections rather than on identity inconsistencies. The business type raises the stakes. USDT purchases and sales are irreversible once transferred, and an exchange aimed at transient visitors in tourist cities leaves very little recourse if the counterparty disappears. The behavioural sandbox did not observe wallet-drainer activity, clipboard manipulation, hidden forms, credential posts to external hosts, or cloaking. However, the homepage generated a high proportion of third-party traffic, including background requests and posts to destinations outside the site's own platform and outside the commonly trusted set. Those flows cannot be attributed to a legitimate purpose, and they compound the detections above. Evidence:

• Homepage: the page title advertises buying and selling USDT in Phuket, Bangkok and Pattaya, and the site is built around that exchange offering.
• Homepage behavioural run: about 12 external background requests and 12 external posts per session, 3 of each to non-whitelisted destinations, with up to 80% of activity going to external hosts.
• Homepage behavioural run: no wallet-provider injection, clipboard writes, hidden forms or cloaking were detected across three successful runs.
• Tracked history: 5 archive snapshots between 2026-09-11 and 2026-09-22 (about 44 days old), consistent with a very recently launched property.

Regulatory Verification Notes

No licence, registration number or named operating entity could be tied to this site from the available evidence. Its identity cannot be independently connected to any real-world company or individual. For a service that converts fiat to stablecoins in Thailand, the legal basis to operate is a material question. The site runs on a free subdomain of a shared hosting platform rather than on its own registered domain, which leaves ownership opacity around who operates it. This is a verification gap, not proof of wrongdoing, but here it coincides with the external detections and offers no mitigating assurance. No third-party broker or regulatory-database entry matched the site, so no external reputational context exists in either direction. Evidence:

• Homepage: no named legal operator or regulatory authorisation could be tied to the exchange service.
• Hosting: served from AS16509 (AMAZON-02, Amazon.com, Inc., US) under the ARIN registry.
• Transport encryption: TLS certificate issued by WR1 (DV, domain validation only), valid to 2026-11-27. DV confirms control of the hostname, not the identity of the operator.
• Domain provenance: roughly 44 days of tracked history, with the first archive capture on 2026-09-11.

What to Verify Next

Any prospective counterparty should first establish whether a legal entity actually stands behind the service. That means asking for a registered company name and checking it against the Thai corporate registry. It also means confirming with the relevant Thai financial and digital-asset authorities whether the entity holds authorisation to deal in digital assets. Official contact channels and any physical exchange locations should be confirmed through an independent, offline route and never through links on the site. Any wallet address supplied by the operator should be treated as unverified until the operator's identity is established. Evidence:

• Homepage: the stated city locations (Phuket, Bangkok, Pattaya) provide concrete claims that can be checked against local business registrations.
• Hosting: the shared-platform subdomain gives no separate domain registration record from which to identify the operator.
• Reputation: the current security detections should be rechecked after any operator response, as listings can change.

Summary Verdict

The site is assessed at the most severe end of the trust scale, driven by current external threat detections that infrastructure quality and technical hygiene cannot offset. The real-world operator remains unidentified. The overall posture is high risk, and the site is not suitable for any sensitive or financial interaction.

Infrastructure Integrity

The site is delivered through a recognised CDN/WAF layer on Amazon-hosted address space. All six observed addresses are edge servers, and no origin server was observable. A valid certificate and a mainstream platform are mitigating factors, but they say nothing about the intent of whoever publishes the content. Edge-only visibility also makes it harder to verify hosting independently and allows content to be swapped rapidly. The 89 abuse reports on record relate to a shared platform address used by many unrelated tenants. They are discounted and are not counted against this site.

Closing Assessment

The site should not be used for login, credential entry, payments or any crypto transfer. At most, it should be viewed in a read-only capacity, and nothing should be downloaded from it. Anyone who has already interacted with it should stop further transfers and secure any related accounts.

Signals weighed against the site

• AbuseIPDB: 89 reports on hosting IP 64.29.17.67 (Vercel, Inc, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.