Is usddswap.org a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

usddswap.org presents itself as a TRON-based decentralized exchange interface for the USDD stablecoin. Its homepage carries a swap terminal, liquidity pools, TRX staking, and a prominent wallet-connection prompt. It describes itself as "the premier decentralized exchange for USDD." The apparent business model is fee capture on swaps routed through TRON pools, plus deposit-based yield products aimed at users who commit USDD or TRX.

Scam/Impersonation Risk

This is the clearest area of concern. The domain is confirmed as blacklisted by multiple independent threat-intelligence sources, including several tier-one security vendors, so it carries a decisive adverse reputation. No conflicting legal identities and no direct brand impersonation were identified. The site calls itself a third-party frontend, yet it trades on the USDD token's name and shows no evidence of authorization by the protocol. The homepage offers swaps from USDD into TRX, USDT, JST and any TRC20 token. It advertises "sub-cent fees," "<0.01% average slippage," and a "$3.1B+" USDD volume counter that nothing verifies. It also shows liquidity pools promoting roughly 7–20% APR, and a TRX staking tab with "free energy." The FAQ says "we never have access to your funds," but the interface is built around pool deposits and signed transactions, which contradicts the claim. The headline TVL of about $2.8B does not reconcile with the stated USDD supply or the listed pool balances, which suggests decorative or fabricated statistics. The terminal also exposes testnet and cross-chain tabs, and 14 wallet integrations are listed. All of this sits behind a connect-and-sign flow that precedes any service. In the sandbox, external requests made up most of the traffic, and several outbound POST and XHR calls went to non-whitelisted destinations. No wallet-drainer or clipboard-hijack behavior was observed, but no wallet was actually connected during testing, so the signing logic remains untested. Evidence:

• Homepage: the domain is listed as malicious or suspicious by many security engines, including three tier-one vendors (9 malicious, 3 suspicious detections); the posture remains cautionary regardless of any single feed.
• Homepage: the "$3.1B+ USDD Volume" counter and the roughly $2.8B TVL are unsupported by any audit or contract reference, and they conflict with the stated USDD supply of about $725M.
• Homepage FAQ: the non-custodial and "never hold your funds" claims are contradicted by the pool-deposit and staking flows on the same page.
• Public DeFi protocol directories have no listing for this site, so the claimed TVL has no independent corroboration.

Regulatory Verification Notes

The site names no operator, legal entity, company address, or contact channel. It claims no license or registration, and it advertises "no KYC." For a platform that takes custody-like deposits, these are material transparency gaps and ownership opacity, not an identity contradiction. A blacklist is separate from licensing: the missing disclosures reflect an unverifiable operator, and the blacklist listing is what moves the posture to high risk. The swap fees of 0.01%–0.3% are described, but the fee-recipient contracts and the swap router contract address are not published, so the flow of value cannot be traced from the site. No third-party broker-review match exists, so no external reputational context is available beyond the threat listings. Evidence:

• Domain registered 2026-07-29 (~0.23 years, about 83 days old) through the registrar Atak Domain Bilgi Teknolojileri; expiry 2027-07-29.
• Web archive holds 1 snapshot, in 2026 (first and last seen 2026-07-31, 1 year tracked), so no meaningful operating history exists.
• Served from AS59692 (IQWeb FZ-LLC, AE); TLS certificate issued by YR1 (DV) and valid to 2027-01-18, a basic encryption check that says nothing about the operator.
• Homepage and FAQ: no operator name, audit report, company address, or support contact is published.

What to Verify Next

Any engagement should begin by confirming whether the official USDD project recognizes this frontend. That means checking the project's own channels, reached independently rather than through links on this site. The swap router and pool contract addresses should be compared against the protocol's published contracts on a TRON block explorer. The advertised TVL, volume, and APR figures should be checked against independent protocol analytics. Official support channels should be confirmed through an independent, offline route before any contact. Finally, the legal entity should be checked in the registry of the relevant jurisdiction, if one can be identified. Evidence:

• Homepage: no swap router contract address is shown, so on-chain verification cannot start from the site itself.
• Homepage: the 7–20% pool APRs and the staking returns are presented as earnings without any stated source of yield.
• Domain registered 2026-07-29 and the single archive snapshot in 2026 mean no prior track record can corroborate any claim.

Summary Verdict

Available evidence places this site firmly in the high-risk category. A confirmed adverse security reputation converges with an unverifiable operator, internally inconsistent financial claims, and a deposit-first interaction model. Nothing in the technical or content evidence is strong enough to offset those findings, and the site is not assessed as trustworthy for any financial purpose.

Infrastructure Integrity

The site resolves to a single IP address at a UAE-based hosting provider (AS59692, IQWeb FZ-LLC), with no CDN or WAF in front of it. It therefore benefits from no protective edge layer that could mitigate exposure. The hosting IP has five abuse reports from three distinct reporters, the most recent about a day before this assessment. Those reports are tied to shared provider infrastructure rather than to this site alone, but they are not discounted and add to the unfavorable picture. The valid certificate and the presence of a hosting ASN are baseline hygiene, not evidence of legitimacy.

Closing Assessment

Wallet connection, transaction signing, deposits, staking, and any credential entry on this site should be avoided. At most, the site should be viewed in a read-only manner, with no funds or approvals committed to it. Anyone seeking USDD services should reach the official protocol through channels verified independently of this site.

Signals weighed against the site

• AbuseIPDB: 5 reports on hosting IP 186.2.175.35 (IQWeb FZ-LLC, Data Center/Web Hosting/Transit), 11% confidence. The reports are attributed to shared infrastructure, not specifically to this website.