Is trustwallet-begonia-038e52.netlify.app a scam? TrustSniffer's high-risk assessment: 5/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a single-page site on a free, shared Netlify-hosted subdomain. Its hostname embeds the name of a well-known crypto wallet brand. The homepage serves a short block of text, and no commercial offering, wallet-connection flow or login form was observed. Its apparent purpose is to present itself as a wallet-branded destination, a pattern that fits brand-lookalike use. The real-world operator behind it is not established.

Scam/Impersonation Risk

This is the decisive area of the assessment. Several established security vendors currently flag the site as malicious, and a further engine marks it suspicious, which amounts to a confirmed blacklist condition. The detections do not specify the exact nature of the threat, so the category of abuse should not be assumed. The hostname combines a recognised wallet brand with a random-looking suffix on a free subdomain platform. That is a classic structure for lookalike pages, and nothing on the site ties it to the brand's genuine operator. Two abuse reports exist against a network address used by the site. They belong to a shared cloud provider address serving many unrelated tenants, so they are discounted and carry no weight against this site. The captured sessions were otherwise quiet: no outbound data submission, no wallet-connection prompts, no hidden forms and no content cloaking. Quiet behaviour on a single page does not offset the external detections, because such a page can be swapped for a malicious one without changing the address. No conflicting legal identities were found. Evidence:

• Homepage and hostname: the wallet-brand name sits inside a free-platform subdomain with a random suffix, which is consistent with a lookalike structure.
• External reputation: 13 security engines rate the site malicious and 1 rates it suspicious, with three major vendors among them.
• Behavioural capture of the homepage: three successful runs recorded no external requests, no form posts to third parties and no wallet-connection activity.
• Abuse reports: 2 reports on a shared-infrastructure address, discounted because they attach to the cloud provider rather than this site.

Regulatory Verification Notes

The captured homepage names no legal entity, registration number, licence or regulator, so the page gives no basis for treating it as an authorised financial or wallet service. This is a verification limit and not evidence of wrongdoing on its own. Here it sits alongside confirmed external detections, so it cannot be read as benign. The valid, organisation-validated transport encryption belongs to the hosting platform, not to any wallet operator, so it shows only that the connection is encrypted and says nothing about who runs the site. No third-party broker or regulatory-database match was found, and no sovereign or institutional trust context applies. Evidence:

• Hosting: served from AS16509 (AMAZON-02, Amazon.com, Inc., US), a general-purpose cloud network that hosts many unrelated sites.
• TLS certificate issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 (OV), subject organisation Netlify, Inc, valid to 2027-03-19.
• Homepage: no company name, licence number or regulator reference is disclosed.

What to Verify Next

Anyone who reached this address through a message, advertisement or search result should compare it against the official channels of the wallet brand named in the hostname. Those channels should be reached by typing the address manually or through the brand's own app listing, never through a link from this site. The site should not be treated as the brand's own unless the brand confirms it. Any request on or from this site to connect a wallet, enter a recovery phrase, or sign a transaction should be treated as illegitimate unless the brand confirms otherwise. The hosting platform's abuse channel can be asked to review the site, and an operator claiming to be legitimate would need to supply a verifiable legal entity and licensing evidence. Official support and contact channels should be confirmed independently through the brand's verified website. Evidence:

• Hostname: the brand-bearing subdomain on a free hosting platform is the main item to check against the brand's official presence.
• Homepage: it shows no licensing or corporate identity that could be checked against a registry.
• External detections: they remain active, so any later change in status should be re-checked before the site is reassessed.

Summary Verdict

The site carries an elevated risk posture. Confirmed external threat detections, together with a brand-bearing hostname on a free subdomain and no verifiable operator identity, outweigh its technical hygiene. Its clean behavioural capture and valid encryption are real but insufficient. Legitimacy is not supported by the available evidence.

Infrastructure Integrity

The site runs on Amazon Web Services edge infrastructure with CDN and WAF protection. All four observed addresses are edge servers, and no origin server address was observable. This is a mitigating factor for availability and transport security, not proof of legitimacy. Because only the edge layer is visible, hosting cannot be verified independently, and content can be replaced quickly behind it. Protective infrastructure cannot offset the reputation risk from the external detections.

Closing Assessment

The site should be limited to read-only viewing at most. Logging in, entering credentials, connecting a wallet, signing transactions and making any financial interaction should be avoided. Anyone who has already interacted with it should treat any wallet or account details they shared as exposed. They should move any funds to a freshly created wallet and revoke any token approvals.

Signals weighed against the site

• AbuseIPDB: 2 reports on hosting IP 2a05:d014:58f:6200::259 (Amazon Data Services Ireland Ltd, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.