Is usdt-transfer-bnb1.netlify.app a scam? TrustSniffer's high-risk assessment: 5/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a single-page site hosted on a free Netlify subdomain. Its title is "Transfer Trust Wallet", and its name suggests a USDT (Tether) transfer on the BNB chain. The page carries almost no text, so a visitor sees only a bare landing page. The apparent purpose is to steer visitors toward a cryptocurrency transfer or wallet-related action, and the site shows no business model, product description, or operator identity.

Scam/Impersonation Risk

The evidence converges on a high-risk, confirmed adverse reputation. Multiple independent security engines classify the site as malicious, including several tier-one vendors, and it is blacklisted by external threat-intelligence sources. A known-phishing indicator was also raised during analysis. The domain name combines crypto-transfer terminology (USDT, BNB) with the title "Transfer Trust Wallet", which echoes a widely used consumer wallet brand. That pattern is typical of lures that pull victims into transferring funds or disclosing wallet credentials. No second legal entity or competing brand identity was found, so impersonation of a specific organisation is not established. The site also showed no wallet-connection prompts, clipboard manipulation, hidden forms, or outbound data submissions during sandbox runs. That clean behaviour does not offset the reputation findings, because a minimal page can be switched to a malicious payload at any time. The page is very thin, which leaves it no legitimate content to support the transfer-related name. Evidence:

• Homepage: the page title reads "Transfer Trust Wallet", and the visible text is only a few dozen characters.
• Reputation scan: 16 security engines flagged the domain as malicious, including three tier-one vendors, which triggered the external blacklist.
• Domain age: the domain is about 0.31 years (~114 days) old, a very young registration for a site that touches financial transfers.
• Sandbox: 3 of 3 runs completed with no external requests, no wallet-drainer activity, and no console errors.

Regulatory Verification Notes

No legal, terms, privacy, or about content identifies an operating company, and the site discloses no licence, registration, or regulatory standing. Cryptocurrency transfer services are regulated in most jurisdictions, so the absence of any such disclosure matters here. Ownership is opaque, and nothing connects the site to a real-world business or individual. No third-party broker or regulatory-database entry exists for it, and no DeFi protocol directory recognises it. The TLS certificate names the hosting platform as its subject organisation, not the site's operator, so it says nothing about who runs the site. This is a verification and transparency finding only. The blacklist and malicious-detection findings above are what drive the elevated risk. Evidence:

• Homepage: no company name, licence number, registry reference, or contact details are published.
• Transport encryption: an OV certificate issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 to Netlify, Inc, valid to 2027-03-19.
• Web archive: 1 snapshot, captured 2026-07-10, so there is no meaningful operating history.
• DeFi directories: the domain is not listed.

What to Verify Next

Before any engagement, the visitor should confirm independently whether the service claims to belong to a known wallet or exchange. That check should use the official channel of that brand, reached through a manually typed address or an official app. Any claimed provider should be checked against the financial or virtual-asset regulator's public register in the relevant jurisdiction. Nothing should be transferred or approved on this site unless an independent route confirms its legitimacy. If the site was reached through a message, advertisement, or social post, the sender should be contacted through a separate, trusted channel. The site may also be reported to the hosting platform and to the browser and security vendors that already flag it. Evidence:

• Homepage: the title and domain name reference a transfer service and a wallet brand without any stated provider.
• Hosting: the site sits on a shared, free subdomain of a deployment platform, so the platform's abuse process applies.
• Reputation scan: the existing detections give a basis for a takedown or abuse report.

Summary Verdict

The site is assessed as high risk. Confirmed adverse threat intelligence, a very young and shallow history, and no identifiable operator outweigh its technically tidy behaviour. The available evidence does not support treating the site as a legitimate service, and it is unsuitable for any sensitive or financial interaction.

Infrastructure Integrity

The site is delivered through Amazon's infrastructure (AMAZON-02, AS16509, US) behind a CDN/WAF layer in front of the Netlify platform. All four observed addresses are edge servers, and no origin address was visible. That prevents independent hosting verification and can mask rapid content changes. The edge infrastructure is a mitigating factor only and cannot offset the reputation findings. Two abuse reports exist against one of the shared edge addresses, but they apply to common provider infrastructure and carry no weight against this site.

Closing Assessment

The site should not be used for logging in, connecting a wallet, sharing seed phrases or credentials, or sending any funds. Any passive viewing should be limited to read-only observation from a device with up-to-date protection, and any prior interaction should be treated as potentially compromising. A user who already interacted should revoke wallet approvals, move assets to a fresh wallet, and change affected passwords.

Signals weighed against the site

• AbuseIPDB: 2 reports on hosting IP 2a05:d014:58f:6200::259 (Amazon Data Services Ireland Ltd, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.