--- title: "Is ucrnbf-zi8usmeu.vercel.app a Scam? Trust Score 0/100" source: TrustSniffer type: Website trust & fraud report subject: "ucrnbf-zi8usmeu.vercel.app" verdict: "Critical Risk" title: "Is ucrnbf-zi8usmeu.vercel.app a Scam? Trust Review, 0/100" trust_score: 0 classification_confidence: 75 canonical_url: https://trustsniffer.com/report/ucrnbf-zi8usmeu.vercel.app assessed: 2026-10-22 --- # Is ucrnbf-zi8usmeu.vercel.app a scam? TrustSniffer's high-risk assessment: 0/100 ## Verdict **Verdict: Critical Risk, trust score 0/100.** ucrnbf-zi8usmeu.vercel.app shows high-risk / scam indicators. This assessment found strong scam indicators. Do not pay, sign in, or share personal details with this site. Labels: Sensitive Interaction Risk, Governance Risk Assessed 2026-10-22 by automated analysis. Classification confidence 75%. ## Evidence status and limitations Evidence completeness: Not recorded - The real-world operator identity was not independently verified. - Module-level completeness metadata is unavailable for this legacy report. ## At a glance The checks that decide most of this verdict. | Check | Result | Status | | --- | --- | --- | | Malware engines | 11 flagged it (VirusTotal) | Risk | | Google Safe Browsing | Not listed (Google) | Clear | | Abuse reports on the host | 0% confidence (AbuseIPDB, 83 reports; shared hosting inflates reports) | Clear | | Domain age | 11 days old (Most scam domains are under a year old) | Risk | | Web archive | Archived since 2026 (2 snapshots) | Clear | | Certificate | Encrypted connection (Issued by WR1) | Noted | ## The page as captured ![Screenshot of the ucrnbf-zi8usmeu.vercel.app homepage captured during the TrustSniffer assessment](https://trustsniffer.com/outputs/ucrnbf-zi8usmeu.vercel.app/screenshots/first.png) _What ucrnbf-zi8usmeu.vercel.app served when TrustSniffer captured it on 2026-10-22. The page may look different now._ ## Key findings - Automated classification: Sensitive Interaction Risk. - Domain age: less than 1 year (registration continuity). - Public web-archive history exists since 2026. - At least one reputation service TrustSniffer consulted had flagged this domain at assessment time. ## Full analysis ### Security Alert Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution. This website is an auto-generated subdomain on a shared application-hosting platform. Its homepage shows only a bare "404: not found" error page with a few hundred characters of text. It presents no products, services, branding or stated business purpose, so its apparent function is that of a disposable or staging endpoint, not a public-facing business. ### Scam/Impersonation Risk This assessment is **cautionary and security-forward**. The site is **confirmed blacklisted**: several independent security engines, including multiple top-tier vendors, flag it as malicious, and this is the decisive factor. The page itself behaves in a way that fits the listings. Its content changes materially after simulated user interaction, even though it first loads as a plain error page. That is a strong cloaking pattern, in which a harmless-looking surface is shown to scanners while different content is served to interacting visitors. Web-archive records also carry a known-phishing marker for this host. Network behaviour adds to the picture. Nearly all page traffic goes to external destinations, including a large volume of background requests and a dozen outbound posts. All of these went to widely recognised services, and the browser clipboard was written to during the sessions. No wallet-connection prompts, hidden forms or credential forms posting to third parties were observed. No brand impersonation or conflicting legal identities were found, and the contradictions stand on the blacklisting and cloaking alone. Abuse reports recorded against one of the platform's shared edge addresses are discounted, because that address is common to many unrelated tenants, so they do not count against this site specifically. Evidence: - Homepage: returns a "404: not found" page with minimal text, yet a strong content shift appears after interaction. - Domain provenance: registered in 2026, about 12 days old at the time of analysis. - Web archive: only 2 snapshots, all from 2026 (1 year tracked), with a known-phishing marker on record. - Reputation checks: flagged as malicious by multiple security engines, including three top-tier vendors. ### Regulatory Verification Notes The captured homepage has no legal, terms, privacy or about pages. It names no operating company, and it shows no licence or registration number or any other disclosure. Ownership and governance are opaque, and no real-world operator can be linked to the host. This is a verification limitation and is not by itself evidence of wrongdoing. Here it adds to the confirmed reputational findings and offers no mitigation. The valid transport-encryption certificate is a baseline technical hygiene item. It says nothing about the intent or identity of whoever controls the content. Evidence: - Homepage: no company name, licence, registration number or policy pages are shown. - Hosting: served from AS16509 (AMAZON-02, Amazon.com, Inc., US). - Transport encryption: TLS certificate issued by WR1 (DV, domain validation only), valid to 2026-11-27 with 36 days remaining. ### What to Verify Next Anyone who received this address from an email, message, advertisement or QR code should treat it as unverified. They should confirm the intended service through its official website or an independently sourced contact channel, not through anything on this host. If a named brand or service is claimed, its own official channels should confirm whether this address belongs to it. The sender should also be asked, by a route other than the one that delivered the link, why this endpoint was supplied. The address should be re-assessed only after the current threat listings are cleared. Evidence: - Homepage: no identifiable brand, service or operator to verify against. - Reputation checks: the current multi-vendor malicious listings are the central open item for any re-assessment. - Behaviour tests: the post-interaction content shift would need to be explained by the operator. ### Summary Verdict The available evidence supports a high-risk posture. Confirmed malicious listings, evasive page behaviour and an unidentified operator converge on one conclusion. They override the technical hygiene signals and the discounted shared-infrastructure reports. The site cannot be treated as legitimate or safe for any sensitive interaction. ### Infrastructure Integrity The site sits behind a trusted, mainstream cloud CDN/WAF. All observed addresses are edge servers on the Amazon network, and the origin server could not be seen. This protective layer is a mitigating factor only. It does not offset the reputational findings. Edge-only visibility also prevents independent verification of hosting and can mask rapid content swaps. ### Closing Assessment Do not sign in, enter credentials, make payments, connect a wallet or download anything from this address. Even read-only visits are best avoided, and any link that points here should be reported to the security team or the sender's platform. _Written analysis generated 2026-10-22 by the TrustSniffer Analysis Engine from the evidence in this report._ ## What the analysis found 5 findings contributed to this verdict, raised by external reputation, hosting and network, history in the web archive, behaviour in a sandbox, registration and ownership. ### 01 External reputation - An external threat feed lists this domain: either Google Safe Browsing marked it malicious, or a significant number of malware engines flagged it. (External reputation `rule:EXT_BLACKLIST_CRITICAL`) ### 02 Hosting and network - The domain was registered less than three months ago. (Hosting and network `rule:DNS_NEW_DOMAIN_90D`) ### 03 History in the web archive - The web archive has almost no record of this domain, which fits a site that is new. (History in the web archive `rule:ARCH_PEN_YOUNG_AND_SPARSE`) ### 04 Behaviour in a sandbox - Most of what the page loaded came from other domains rather than from this one. (Behaviour in a sandbox `rule:BEHAV_EXTERNAL_RATIO_HIGH`) ### 05 Registration and ownership - The public registration record for this domain is incomplete. (Registration and ownership `rule:KF_WHOIS_INCOMPLETE`) ### Signals weighed against the site - AbuseIPDB: 83 reports on hosting IP 216.198.79.67 (Vercel, Inc, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website. ## Identity verification | Field | Value | | --- | --- | | Status | UNKNOWN | | Identity score | 50/100 | | Identity verification confidence | 30% | - AI page analysis unavailable (page captured; identity not AI-verified) _Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence._ ## What TrustSniffer observed First-party facts recorded during the assessment of ucrnbf-zi8usmeu.vercel.app. - The request stayed on ucrnbf-zi8usmeu.vercel.app. It was not redirected to another domain. (Clear) - The earliest public archive of this site is from 2026-10-10. (Clear) - It is hosted on AMAZON-02, from a server in US. (Noted) ## Domain intelligence | Field | Value | | --- | --- | | Registrar | Not available | | Hosting | AMAZON-02 - Amazon.com, Inc., US | | Country | US | | Server IP | 216.198.79.67 | | Name servers | Not available | | CDN / edge network | Detected | | Resolved IP addresses | 6 | | Edge IP addresses | 6 | | Likely origin IP addresses | 0 | | SSL issuer | WR1 | | SSL expiry | 2026-11-27 | | Domain age | 0.03 years (continuous registration) | | Domain expiry | Not available | | Archive first seen | 2026-10-10 | | Archive snapshots | 2 | | Reputation | VirusTotal: 11 flagged \| AbuseIPDB: 0% confidence, 83 reports \| Google Safe Browsing: 0 matches | ## About this assessment **Was this report useful?** Tell other people what you think of TrustSniffer, good or bad. An honest review helps others decide whether to rely on these checks. [Review TrustSniffer on Trustpilot](https://www.trustpilot.com/review/trustsniffer.com) A trust score summarises the evidence TrustSniffer could collect about ucrnbf-zi8usmeu.vercel.app at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present. TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed. ## Related on TrustSniffer - [photon-trading.vercel.app](https://trustsniffer.com/report/photon-trading.vercel.app), a similar name (Critical Risk, 5/100) - [smartsoltokenfix.vercel.app](https://trustsniffer.com/report/smartsoltokenfix.vercel.app), a similar name (Critical Risk, 0/100) - [v2-paraswap.vercel.app](https://trustsniffer.com/report/v2-paraswap.vercel.app), a similar name (Critical Risk, 0/100) - [sendusdt-2.vercel.app](https://trustsniffer.com/report/sendusdt-2.vercel.app), a similar name (Critical Risk, 5/100) - [arcadepadapp.vercel.app](https://trustsniffer.com/report/arcadepadapp.vercel.app), a similar name (Critical Risk, 16/100) - [send-usdt-1-chi.vercel.app](https://trustsniffer.com/report/send-usdt-1-chi.vercel.app), a similar name (Critical Risk, 5/100) - [mmmm-lilac.vercel.app](https://trustsniffer.com/report/mmmm-lilac.vercel.app), a similar name (Critical Risk, 5/100) - [getblockaml.vercel.app](https://trustsniffer.com/report/getblockaml.vercel.app), a similar name (Critical Risk, 0/100) - [crypto-pfw.netlify.app](https://trustsniffer.com/report/crypto-pfw.netlify.app), another .app site assessed as critical-risk (Critical Risk, 0/100) - [pump-streamfor.fun](https://trustsniffer.com/report/pump-streamfor.fun), another site assessed as critical-risk (Critical Risk, 16/100) - [Every website and wallet TrustSniffer has assessed](https://trustsniffer.com/directory), the full risk directory - [Other domains assessed as high-risk or phishing](https://trustsniffer.com/directory/phishing-domains), same verdict band - [Check another website](https://trustsniffer.com/web-intelligence), run a new assessment - [Check a crypto wallet address](https://trustsniffer.com/on-chain-risk), on-chain screening - [The TrustSniffer Risk Index](https://trustsniffer.com/stats), how this verdict compares ## Guides - [Stablecoin Freezes, Oct 26, 2026: 11 Wallets](https://trustsniffer.com/blog/stablecoin-freeze-report-2026-10-26) - [99.5% of flagged USDT wallets were frozen](https://trustsniffer.com/blog/99-5-of-flagged-usdt-wallets-were-frozen) - [Trading Platform Scam: Checking a Blocked Balance](https://trustsniffer.com/blog/trading-platform-scam-checking-a-blocked-balance) --- *Source: [TrustSniffer](https://trustsniffer.com/report/ucrnbf-zi8usmeu.vercel.app) — independent automated trust & fraud analysis. Cite as https://trustsniffer.com/report/ucrnbf-zi8usmeu.vercel.app · assessed 2026-10-22.*