Is upgraded-eth.vercel.app a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

The website is a short-lived deployment on a shared, free-tier application-hosting platform. A visitor sees only a "Deployment Unavailable" error screen with a request identifier. The screen has no branding, navigation, forms, links, or description of any service, so its purpose and business model cannot be determined from what it shows.

Scam/Impersonation Risk

Contradictory signals are present. The site is on a security blacklist, with more than a dozen independent security engines classifying it as malicious, including several top-tier vendors. This is the decisive finding, and it reflects the reputation of the site itself. The error page shows no content that could explain or excuse these detections. Separately, 81 abuse reports exist against a Vercel edge address that serves this site. They were reviewed and discounted because that address is shared by many unrelated tenants, so they are not attributed to this site. A naming heuristic also flags a close resemblance between the hostname and the hosting platform's own namespace. This was not confirmed as impersonation, and no identity contradiction or phishing form was observed. The hostname's Ethereum-upgrade theme could serve as a lure for crypto users, but the visible page contains no crypto functionality. The capture itself returned a restricted-access status code, which is consistent with the platform or a third party having withheld the content. The combination of a very new, thin, blacklisted deployment with no accountable operator presents elevated risk to anyone who might later reach live content at this address. Evidence:

• Homepage: only the text "Deployment Unavailable" and a request identifier were captured, which is 92 characters of content with no forms, links, or login fields. The page was captured with an access-restricted HTTP 451 status.
• Reputation: 13 security engines flag the site as malicious, including three top-tier vendors. This triggered the maximum-severity reputation cap.
• Provenance: the web archive holds 1 snapshot, first and last seen on 2026-10-01 (1 year tracked), and the domain's observed history is about 19 days (about 0.05 years). That is a very new footprint.
• Sandbox: three behavioral runs showed no external network calls, no hidden forms, no cloaking, and no wallet-connection attempts, so the risk comes from reputation rather than observed page behavior.

Regulatory Verification Notes

The site claims no license, regulator, or registration. The only observable page is an error screen with no legal, terms, privacy, or about content, so there is no on-site identity or governance disclosure to evaluate. The operator is not independently linked to any real-world person or brand, and ownership and governance are opaque. The site is a subdomain of a shared hosting platform, so it has no independent domain registration of its own. No third-party broker or regulatory-database record matched, and the absence of one is not treated as a verdict. The security-vendor detections are the only third-party reputational signal in play. Evidence:

• Homepage and site structure: no legal, privacy, terms, or contact pages were observable, and no license or registration number is stated.
• Hosting: served from AS16509 (AMAZON-02, Amazon.com, Inc., US, ARIN registry).
• Transport security: the TLS certificate is issued by WR1 at domain-validation (DV) level only, valid to 2026-11-27. DV confirms control of the hostname, not the operator's identity.
• Third-party broker coverage: no matching entry was found, which gives no support for any claim of regulated status.

What to Verify Next

Any project, token, or upgrade campaign that points to this address should be checked through a channel independent of it, such as the official website, verified social accounts, or the documentation of the claimed brand. The claimed operator should be asked directly, through an offline or separately sourced route, whether the deployment is theirs. Any wallet-connection, signing, or token-approval prompt that later appears here should be treated as unverified until that confirmation is obtained. The deployment should also be re-assessed only after its content is restored and the security detections have been formally delisted. Official support and contact channels should be confirmed from the claimed brand's own verified properties, not from this site. Evidence:

• Homepage: no operator, product, or brand claim exists that could be cross-checked, so confirmation must come from outside the site.
• Reputation: the current detections remain active, so a clean re-scan is a precondition for any renewed assessment.
• Provenance: the 2026-10-01 single archive capture gives no earlier benign history to compare against.

Summary Verdict

The site is assessed as high-risk. Active blacklisting by multiple major security vendors is decisive, and a new, content-free deployment with an unidentified operator offers nothing to offset it. Legitimacy is not established, and the evidence supports a clearly cautionary posture.

Infrastructure Integrity

The site is delivered through Vercel's content-delivery edge on Amazon-hosted address space. All six observed addresses are edge nodes, and no origin server was observable. Edge-only visibility prevents independent hosting verification and allows content to be swapped quickly. The platform's protection is a mitigating factor only. It does not offset the reputation findings, and the shared nature of the edge explains why the abuse reports were discounted.

Closing Assessment

Treat this address as read-only at most. Do not log in, enter credentials, connect a wallet, approve transactions, or make any payment through it. Do not download anything from it.

Signals weighed against the site

• AbuseIPDB: 81 reports on hosting IP 64.29.17.131 (Vercel, Inc, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.