Verdict
This assessment found strong scam indicators. Do not pay, sign in, or share personal details with this site.
ucrnbf-zi8usmeu.vercel.app shows high-risk / scam indicators.
Evidence status and limitations
Evidence completeness: Not recorded
- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.
At a glance
The checks that decide most of this verdict.
| Malware engines | 11 flagged itVirusTotal | Risk |
|---|---|---|
| Google Safe Browsing | Not listedGoogle | Clear |
| Abuse reports on the host | 0% confidenceAbuseIPDB, 83 reports; shared hosting inflates reports | Clear |
| Domain age | 11 days oldMost scam domains are under a year old | Risk |
| Web archive | Archived since 20262 snapshots | Clear |
| Certificate | Encrypted connectionIssued by WR1 | Noted |
The page as captured
Key findings
- Automated classification: Sensitive Interaction Risk.
- Domain age: less than 1 year (registration continuity).
- Public web-archive history exists since 2026.
- At least one reputation service TrustSniffer consulted had flagged this domain at assessment time.
Full analysis
Security Alert
Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.
This website is an auto-generated subdomain on a shared application-hosting platform. Its homepage shows only a bare "404: not found" error page with a few hundred characters of text. It presents no products, services, branding or stated business purpose, so its apparent function is that of a disposable or staging endpoint, not a public-facing business.
Scam/Impersonation Risk
This assessment is cautionary and security-forward. The site is confirmed blacklisted: several independent security engines, including multiple top-tier vendors, flag it as malicious, and this is the decisive factor. The page itself behaves in a way that fits the listings. Its content changes materially after simulated user interaction, even though it first loads as a plain error page. That is a strong cloaking pattern, in which a harmless-looking surface is shown to scanners while different content is served to interacting visitors. Web-archive records also carry a known-phishing marker for this host. Network behaviour adds to the picture. Nearly all page traffic goes to external destinations, including a large volume of background requests and a dozen outbound posts. All of these went to widely recognised services, and the browser clipboard was written to during the sessions. No wallet-connection prompts, hidden forms or credential forms posting to third parties were observed. No brand impersonation or conflicting legal identities were found, and the contradictions stand on the blacklisting and cloaking alone. Abuse reports recorded against one of the platform's shared edge addresses are discounted, because that address is common to many unrelated tenants, so they do not count against this site specifically.
- Homepage: returns a "404: not found" page with minimal text, yet a strong content shift appears after interaction.
- Domain provenance: registered in 2026, about 12 days old at the time of analysis.
- Web archive: only 2 snapshots, all from 2026 (1 year tracked), with a known-phishing marker on record.
- Reputation checks: flagged as malicious by multiple security engines, including three top-tier vendors.
Regulatory Verification Notes
The captured homepage has no legal, terms, privacy or about pages. It names no operating company, and it shows no licence or registration number or any other disclosure. Ownership and governance are opaque, and no real-world operator can be linked to the host. This is a verification limitation and is not by itself evidence of wrongdoing. Here it adds to the confirmed reputational findings and offers no mitigation. The valid transport-encryption certificate is a baseline technical hygiene item. It says nothing about the intent or identity of whoever controls the content.
- Homepage: no company name, licence, registration number or policy pages are shown.
- Hosting: served from AS16509 (AMAZON-02, Amazon.com, Inc., US).
- Transport encryption: TLS certificate issued by WR1 (DV, domain validation only), valid to 2026-11-27 with 36 days remaining.
What to Verify Next
Anyone who received this address from an email, message, advertisement or QR code should treat it as unverified. They should confirm the intended service through its official website or an independently sourced contact channel, not through anything on this host. If a named brand or service is claimed, its own official channels should confirm whether this address belongs to it. The sender should also be asked, by a route other than the one that delivered the link, why this endpoint was supplied. The address should be re-assessed only after the current threat listings are cleared.
- Homepage: no identifiable brand, service or operator to verify against.
- Reputation checks: the current multi-vendor malicious listings are the central open item for any re-assessment.
- Behaviour tests: the post-interaction content shift would need to be explained by the operator.
Summary Verdict
The available evidence supports a high-risk posture. Confirmed malicious listings, evasive page behaviour and an unidentified operator converge on one conclusion. They override the technical hygiene signals and the discounted shared-infrastructure reports. The site cannot be treated as legitimate or safe for any sensitive interaction.
Infrastructure Integrity
The site sits behind a trusted, mainstream cloud CDN/WAF. All observed addresses are edge servers on the Amazon network, and the origin server could not be seen. This protective layer is a mitigating factor only. It does not offset the reputational findings. Edge-only visibility also prevents independent verification of hosting and can mask rapid content swaps.
Closing Assessment
Do not sign in, enter credentials, make payments, connect a wallet or download anything from this address. Even read-only visits are best avoided, and any link that points here should be reported to the security team or the sender's platform.
Written analysis generated 2026-10-22 by the TrustSniffer Analysis Engine from the evidence in this report.
What the analysis found
5 findings contributed to this verdict, raised by external reputation, hosting and network, history in the web archive, behaviour in a sandbox, registration and ownership.
01 External reputation
- An external threat feed lists this domain: either Google Safe Browsing marked it malicious, or a significant number of malware engines flagged it.External reputation
rule:EXT_BLACKLIST_CRITICAL
02 Hosting and network
- The domain was registered less than three months ago.Hosting and network
rule:DNS_NEW_DOMAIN_90D
03 History in the web archive
- The web archive has almost no record of this domain, which fits a site that is new.History in the web archive
rule:ARCH_PEN_YOUNG_AND_SPARSE
04 Behaviour in a sandbox
- Most of what the page loaded came from other domains rather than from this one.Behaviour in a sandbox
rule:BEHAV_EXTERNAL_RATIO_HIGH
05 Registration and ownership
- The public registration record for this domain is incomplete.Registration and ownership
rule:KF_WHOIS_INCOMPLETE
Signals weighed against the site
- AbuseIPDB: 83 reports on hosting IP 216.198.79.67 (Vercel, Inc, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.
Identity verification
| Status | UNKNOWN |
|---|---|
| Identity score | 50/100 |
| Identity verification confidence | 30% |
- AI page analysis unavailable (page captured; identity not AI-verified)
Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence.
What TrustSniffer observed
First-party facts recorded during the assessment of ucrnbf-zi8usmeu.vercel.app.
- The request stayed on ucrnbf-zi8usmeu.vercel.app. It was not redirected to another domain. Clear
- The earliest public archive of this site is from 2026-10-10. Clear
- It is hosted on AMAZON-02, from a server in US. Noted
Domain intelligence
| Registrar | Not available |
|---|---|
| Hosting | AMAZON-02 - Amazon.com, Inc., US |
| Country | US |
| Server IP | 216.198.79.67 |
| Name servers | Not available |
| CDN / edge network | Detected |
| Resolved IP addresses | 6 |
| Edge IP addresses | 6 |
| Likely origin IP addresses | 0 |
| SSL issuer | WR1 |
| SSL expiry | 2026-11-27 |
| Domain age | 0.03 years (continuous registration) |
| Domain expiry | Not available |
| Archive first seen | 2026-10-10 |
| Archive snapshots | 2 |
| Reputation | VirusTotal: 11 flagged | AbuseIPDB: 0% confidence, 83 reports | Google Safe Browsing: 0 matches |
About this assessment
A trust score summarises the evidence TrustSniffer could collect about ucrnbf-zi8usmeu.vercel.app at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.
TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.