Is trustwalletindia.vercel.app a scam? TrustSniffer's high-risk assessment: 5/100

Security Alert

Fortinet flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a subdomain on a shared application-hosting platform, with a hostname that echoes the name of a well-known crypto wallet brand and adds an India regional label. When captured, its homepage showed only a short "Deployment Unavailable" notice, with no products, services, or visible business content. Its apparent purpose cannot be established from what it presents, and the branded hostname on a free hosting namespace is a pattern commonly used to stage wallet-related lures.

Scam/Impersonation Risk

Contradictory signals are present and decisive. Several independent threat-intelligence engines classify the site as malicious, one of them a tier-one security vendor, and the host is blacklisted by external reputation sources. The hostname also pairs a recognised wallet brand with a regional qualifier on a platform where anyone can register a name. That wording was not independently tied to the brand owner, so brand impersonation is a credible concern but not a confirmed finding. The 84 abuse reports against the address the site resolves to are discounted. They sit on a provider-shared address serving many tenants and cannot be attributed to this site, so they add no weight here. The page captured nothing to analyse. The sandbox saw no outbound requests, no wallet-connection attempts, no clipboard manipulation and no hidden forms. That absence is not reassurance, because the placeholder state could be a takedown, a suspension or a dormant staging page that can be swapped for live content. Credential entry and any financial interaction are unsafe. Evidence:

• Homepage: the captured page carried the title "Deployment Unavailable", about ninety characters of text, and a legal-restriction style HTTP status.
• Reputation checks: five engines rated the domain malicious and one suspicious, with the blacklist status confirmed by external sources.
• Hostname: the brand-plus-region wording sits on a shared hosting namespace and closely resembles the platform's own naming, which suits lookalike abuse.
• Behaviour: three successful sandbox runs showed zero external requests and no wallet-connect activity.

Regulatory Verification Notes

The captured page has no legal, terms, privacy, about or contact content. It names no operating company, licence or registration, so the site's real-world operator is not independently verified and nothing links it to the wallet brand its hostname evokes. These are verification limits and are not by themselves evidence of wrongdoing. They matter here only because they come with confirmed adverse reputation findings. The broker-reputation database returned no match, which is neither a clearance nor a warning. The transport-security layer is routine and does not establish identity. Evidence:

• Homepage: no company name, registration number, regulator reference or policy page appeared in the captured content.
• Hosting: served from AS16509 (AMAZON-02, Amazon.com, Inc., US).
• Transport encryption: TLS certificate issued by WR1 (DV, domain validation only), valid to 2026-11-27 with 36 days remaining, so it proves domain control and nothing about the operator.
• Third-party broker reputation: no matching record, so no signal either way.

What to Verify Next

Before any engagement, obtain the wallet brand's official website and app links from its own verified channels, such as its official social profiles or app-store listings. Compare them with this hostname rather than relying on anything this site links to. Anyone who has already visited, connected a wallet to, or entered a seed phrase or credentials on the site should treat those assets and accounts as potentially exposed. They should move funds and rotate credentials from a clean device. Security teams should check whether the domain is being circulated in messages, advertisements or search results, and report it to the hosting provider's abuse channel and to the brand owner. Any later change to the page, such as a wallet-connect prompt or a download, should be treated as escalation and re-assessed, not as a sign of recovery. Evidence:

• Hostname: the brand-plus-region wording on a shared namespace is the item to compare with the brand's official domain.
• Homepage: the placeholder state means any later content change is a material event.
• Reputation checks: the confirmed adverse detections make independent confirmation a precondition for any interaction.

Summary Verdict

The overall posture is high risk. Multiple independent security sources flag the site as malicious, and its identity is unverified. The mitigating technical features present, such as a valid certificate and quiet sandbox behaviour, do not outweigh the confirmed adverse reputation findings.

Infrastructure Integrity

The site is delivered through a trusted, large-scale cloud and edge provider. All six observed addresses are edge nodes, and no origin server address was observable. That is a mitigating factor for availability and resilience only, and it neither vouches for the operator nor offsets the reputation findings. Edge-only visibility also prevents independent verification of where the content is actually hosted and allows content to be swapped quickly without any change to the hostname.

Closing Assessment

The site should be avoided for logins, wallet connections, downloads, seed-phrase entry and any payment. At most, it may be viewed passively from an isolated environment, and users should rely only on the brand's officially published addresses instead of this one.

Signals weighed against the site

• AbuseIPDB: 84 reports on hosting IP 216.198.79.3 (Vercel, Inc, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.