Verdict
This assessment found strong scam indicators. Do not pay, sign in, or share personal details with this site.
usdt-bep20-check.vercel.app shows high-risk / scam indicators.
| What this site appears to be | A minimal Trust Wallet-branded USDT send screen asking for a destination address or domain name, an amount, and a Next action. The page lacks the domain, legal identity, fee, and network context needed to confirm it is an official wallet, so the transfer interaction is high-stakes with missing proof. |
|---|
Evidence status and limitations
Evidence completeness: Not recorded
- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.
At a glance
The checks that decide most of this verdict.
| Malware engines | 10 flagged itVirusTotal | Risk |
|---|---|---|
| Google Safe Browsing | Not listedGoogle | Clear |
| Abuse reports on the host | 0% confidenceAbuseIPDB, 80 reports; shared hosting inflates reports | Clear |
| Domain age | Not availableNo registration record was returned | Noted |
| Certificate | Encrypted connectionIssued by WR1 | Noted |
| Hosted by | AMAZON-02Server in US | Noted |
The page as captured
Key findings
- Automated classification: Sensitive Interaction Risk.
- At least one reputation service TrustSniffer consulted had flagged this domain at assessment time.
- The operator behind the site could not be independently connected to a real-world brand or person.
Full analysis
Security Alert
Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.
This website is a single-page, Trust Wallet-branded USDT transfer screen titled "Transfer Trust Wallet". It shows a field for a destination address or domain name, an amount field with a "Max" shortcut, and a "Next" button. Its apparent purpose is to collect a stablecoin transfer instruction from a visitor. It shows no company, fee schedule, network, or custody information, and no navigation, legal pages, or contact channels.
Scam/Impersonation Risk
Material contradictory signals are present, and the posture is clearly cautionary. Multiple independent security engines currently flag the domain as malicious, including several tier-one vendors, and an external blacklist condition is confirmed. This is the decisive factor. The page presents itself as a Trust Wallet send flow, but it is served from a free subdomain on a generic application-hosting platform. The hostname is built around "usdt-bep20-check", which is not a Trust Wallet property. A branded wallet screen on an unrelated, disposable-style hostname, paired with a request for a destination address and amount, is the classic structure of a funds-diversion or deposit-redirection lure. The site's own content gives no counter-evidence. The page analysis flagged unverified crypto-wallet payments, a high-stakes interaction without supporting proof, a mismatch between the branding claimed and the evidence offered, and an unverifiable legal status. Browser behaviour testing found no wallet-drainer routines, clipboard tampering, hidden forms, or cloaking, so the risk lies in the lure and the reputation signals rather than in observed exploit code. Reports of abuse against the shared hosting address are not attributed to this site and were discounted. They do not drive the conclusion. No conflicting legal identities were found, because the page names no entity at all. Evidence:
- Homepage: the only visible content is a "Send USDT" form with "Address or Domain Name", "Amount", "Max", and "Next" controls, branded "Trust Wallet".
- Reputation: 10 security engines currently classify the domain as malicious, including three tier-one vendors.
- Hosting address: 80 abuse reports were logged against the shared hosting IP (64.29.17.131), attributed to shared infrastructure and discounted.
- Behaviour sandbox: 3 of 3 runs completed with no external posts, no cloaking, and no wallet-drainer or clipboard activity.
Regulatory Verification Notes
The page provides no legal entity name, licence, registration number, jurisdiction, terms, privacy policy, or support channel. For a page that initiates a movement of funds, this absence leaves ownership and governance opaque and prevents any link to the real Trust Wallet organisation. No third-party broker or regulatory-database match exists for this domain, so there is no reputational signal in either direction. The missing disclosures do not by themselves indicate fraud, but combined with the external threat detections they remove any basis for treating the site as an official or regulated service. The site claims no licence, so none can be verified. Evidence:
- Homepage: no company name, licensing statement, terms, or privacy notice is present, and the page contains no internal or external links.
- Page metadata: the page has no meta description, canonical reference, or structured data, and the document title is the generic "Transfer Trust Wallet".
- Transport encryption: the TLS certificate was issued by WR1 at domain-validation level only, valid to 2026-11-27 (37 days remaining), which confirms encryption but not operator identity.
What to Verify Next
Any wish to send funds through this page should be abandoned in favour of the official Trust Wallet application, obtained directly from the vendor's own channels and not through any link that led here. The origin of the link or message that directed a visitor to this page should be identified, since delivery through unsolicited messages is a strong lure indicator. Any wallet address or transfer already entered should be treated as potentially compromised and reviewed on the relevant blockchain explorer. Official support channels should be confirmed through an independent route. Organisations should block the hostname at the email and web-gateway layers and report it to the hosting platform's abuse desk. Evidence:
- Homepage: the form accepts a free-text destination and amount, and the page offers no confirmation, network selection, or fee disclosure for the transfer.
- Hostname: the domain is a subdomain of a public application-hosting platform, so the platform's abuse process is the direct takedown route.
- Reputation: the current malicious classifications mean the page is already flagged for removal and blocking.
Summary Verdict
The assessment is critical and the posture is high-risk. The decisive factors are the confirmed external threat detections, a funds-transfer interaction with no identifying proof, and an unverified relationship to the brand it displays. Technical hygiene such as valid encryption and quiet runtime behaviour is insufficient to offset these findings, and the real-world operator remains unverified.
Infrastructure Integrity
The site is served from Amazon-operated address space (AS16509, US, ARIN) behind the application-hosting platform's edge network. Every observed address belongs to that edge layer and no origin server was visible, so the underlying host cannot be independently verified and content can be swapped quickly. The protective infrastructure is a minor mitigating factor only. It does not offset the reputation findings, and it says nothing about who operates the page. Evidence:
- Hosting: served from AS16509 (AMAZON-02, Amazon.com, Inc., US) via 8 observed edge IPs and 0 origin candidates.
Closing Assessment
The page should not be used for any transfer, wallet connection, login, or credential entry. Read-only observation for analysis is the only appropriate interaction. Anyone who has already interacted with it should move assets to a freshly generated wallet and review account activity immediately.
Written analysis generated 2026-10-21 by the TrustSniffer Analysis Engine from the evidence in this report.
What the analysis found
2 findings contributed to this verdict, raised by external reputation, page content.
01 External reputation
- An external threat feed lists this domain: either Google Safe Browsing marked it malicious, or a significant number of malware engines flagged it.External reputation
rule:EXT_BLACKLIST_CRITICAL
02 Page content
- The page content shows three or more warning signs that deceptive sites commonly use.Page content
rule:PAGE_RED_FLAGS_STRONG - The page shows few of the signs expected from a trustworthy operator.Page content
rule:PAGE_TRUST_QUALITY_LOW - The page appears to present itself as a known brand it is not verified to belong to.Page content
rule:PAGE_BRAND_SUSPECTED - The page content shows at least one warning sign that deceptive sites commonly use.Page content
rule:PAGE_RED_FLAGS_SOME - The page has very little readable content.Page content
rule:PAGE_CONTENT_THIN
Signals weighed against the site
- AbuseIPDB: 80 reports on hosting IP 64.29.17.131 (Vercel, Inc, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.
Identity verification
| Status | UNVERIFIED |
|---|---|
| Identity score | 30/100 |
| Identity verification confidence | 50% |
- No on-site identity signals detected
Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence.
What TrustSniffer observed
First-party facts recorded during the assessment of usdt-bep20-check.vercel.app.
- The request stayed on usdt-bep20-check.vercel.app. It was not redirected to another domain. Clear
- It is hosted on AMAZON-02, from a server in US. Noted
Domain intelligence
| Registrar | Not available |
|---|---|
| Hosting | AMAZON-02 - Amazon.com, Inc., US |
| Country | US |
| Server IP | 64.29.17.131 |
| Name servers | Not available |
| CDN / edge network | Detected |
| Resolved IP addresses | 8 |
| Edge IP addresses | 8 |
| Likely origin IP addresses | 0 |
| SSL issuer | WR1 |
| SSL expiry | 2026-11-27 |
| Domain age | Not available (no registration date was returned) |
| Domain expiry | Not available |
| Archive first seen | Not available |
| Archive snapshots | Not counted (archive lookup incomplete) |
| Reputation | VirusTotal: 10 flagged | AbuseIPDB: 0% confidence, 80 reports | Google Safe Browsing: 0 matches |
About this assessment
A trust score summarises the evidence TrustSniffer could collect about usdt-bep20-check.vercel.app at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.
TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.