Is usdt-fixedfloat.vercel.app a scam? TrustSniffer's high-risk assessment: 3/100

Security Alert

Fortinet, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a single-page crypto-exchange front end hosted on a free subdomain of a shared application-hosting platform. Its title and content present it as "FixedFloat USDT", offering instant USDT swaps, staking and a bridge on the TRON TRC-20 network. It appears intended to attract visitors who want to exchange or stake stablecoins. It shows no standalone brand domain of its own.

Scam/Impersonation Risk

This is the most serious area of the assessment, because several independent external detections converge. Multiple security engines currently flag the site as malicious, and two of the more prominent engines are among them. The overall detection count is high enough to trigger an automatic hard ceiling on the trust outcome, and the site is blacklisted by third-party threat intelligence. The decisive concern is therefore not infrastructure quality but active reputational condemnation of this specific address. The site presents a well-known exchange name on a throwaway platform subdomain that closely resembles the platform's own domain. That pairing is a recognised pattern in lookalike exchange fronts, and its visible risk implications are strongest for anyone considering the swap or staking functions with real funds. The abuse reports logged against a nearby platform IP are a separate matter. They concern shared provider infrastructure and carry a minimal confidence rating, so they are discounted and are not treated as evidence against this site. No conflicting legal entities were found, and no wallet-drainer, clipboard-hijack, hidden-form or cloaking behaviour was observed in sandbox runs. Those absences do not offset the active detections. The runtime profile shows heavy third-party communication: a large share of page traffic goes to external hosts, and a portion of the external requests and data submissions go to destinations outside the recognised-service set. Evidence:

• Homepage: the page title advertises "FixedFloat USDT – Instant USDT Swap, Staking & Bridge on TRON TRC-20", and the site is served from a free platform subdomain rather than a dedicated brand domain.
• Domain provenance: the domain was registered about 0.47 years ago (roughly 173 days), and the web archive holds only 2 snapshots, both dated 2026-05-05, so there is effectively no track record.
• Homepage runtime behaviour: 14 external XHR calls and 15 external POST requests were recorded, 6 of each to non-whitelisted destinations, plus 6 console errors across 3 successful runs.
• Threat-intelligence status: 12 engines flag the site as malicious and 1 as suspicious, which is the basis of the hard ceiling on the outcome.

Regulatory Verification Notes

No licence, registration number, named operating company or regulator reference could be tied to this site, and the operator could not be independently connected to a real-world brand or person. This is a disclosure gap alone, not proof of wrongdoing. It carries more weight here because the site offers custody-adjacent financial functions (swapping, staking and bridging) and the external reputation is already adverse. No third-party broker or regulatory-database match was found for the site. Ownership and governance opacity are both present, and they weaken any presumption of accountability. Evidence:

• Homepage: it names no legal entity, licence or regulator, and the swap, staking and bridge services are offered without any disclosed oversight.
• Hosting: the site is served from AS16509 (AMAZON-02, Amazon.com, Inc., US) under the ARIN registry.
• Transport encryption: the TLS certificate is issued by WR1 at DV (domain-validated) level and is valid to 2026-11-27, with 32 days remaining. DV validation confirms only control of the domain, not the operator's identity.
• Directory status: the site is not recognised in the DeFi protocol directory, so there is no independent protocol footprint to corroborate its claims.

What to Verify Next

Independent confirmation should come first. The claimed brand's official website and support channels should be reached through an offline or independently sourced route, to establish whether this subdomain is officially affiliated with that service. Any licence or registration claim should be checked directly with the relevant financial regulator's public registry, since none is stated on the site. The external detections should be rechecked against the original threat-intelligence sources, and a clean result should be seen before any reassessment. Evidence:

• Homepage: the brand claim on the page is unsupported by any visible link to an officially verified brand domain.
• Domain provenance: with a registration age of about 0.47 years and 2 archive snapshots, no historical record exists to confirm continuity with any established service.
• Threat-intelligence status: the active detections would have to clear on their own sources before the site could be reassessed.

Summary Verdict

The overall posture is high-risk. Converging external threat detections, a very recent domain with no meaningful history, and an unverified operator identity outweigh the technically sound transport security and legitimate hosting platform. The site is treated as an unsafe venue for sensitive or financial interaction. Its exchange branding is unsupported by independent evidence of affiliation.

Infrastructure Integrity

The site is served through a CDN/WAF layer on Amazon-operated address space, with all observed addresses being edge servers and no origin server visible. This protective layer and the valid certificate are mitigating signals only. They show the platform is professionally operated, but they do not vouch for the content or operator behind this subdomain. Edge-only visibility also prevents independent hosting verification and can mask rapid content swaps, which adds some uncertainty to a profile that is already cautionary.

Closing Assessment

Use should be limited to passive, read-only viewing. Wallets should not be connected, no credentials or personal data entered, and no funds swapped, staked or bridged through this site. Anyone seeking the named exchange service should reach it only through an officially verified channel obtained independently of this address.

Signals weighed against the site

• AbuseIPDB: 82 reports on hosting IP 64.29.17.131 (Vercel, Inc, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.