Verdict
This assessment found strong scam indicators. Do not pay, sign in, or share personal details with this site.
usdttransferhub.netlify.app shows high-risk / scam indicators.
Evidence status and limitations
Evidence completeness: Not recorded
- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.
At a glance
The checks that decide most of this verdict.
| Malware engines | 13 flagged itVirusTotal | Risk |
|---|---|---|
| Google Safe Browsing | Not listedGoogle | Clear |
| Abuse reports on the host | 1% confidenceAbuseIPDB, 4 reports; shared hosting inflates reports | Clear |
| Domain age | Not availableNo registration record was returned | Noted |
| Web archive | Never archivedNo public history of this site | Watch |
| Certificate | Encrypted connectionIssued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 | Noted |
The page as captured
Key findings
- Automated classification: Sensitive Interaction Risk.
- At least one reputation service TrustSniffer consulted had flagged this domain at assessment time.
Full analysis
Security Alert
Fortinet, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.
The website at usdttransferhub.netlify.app is a minimal, single-page site titled "Transfer Trust Wallet". It presents a very small amount of text and positions itself around transferring USDT, a dollar-pegged stablecoin, through a wallet-style interface. It is hosted as a subdomain of a free, public site-hosting platform rather than on a dedicated, independently registered domain. Its apparent purpose is a cryptocurrency transfer or wallet utility, but the page identifies no operator, product description, fee structure or support channel.
Scam/Impersonation Risk
This site carries a confirmed blacklist listing and an elevated risk of being used for crypto-asset theft or phishing. Multiple independent security engines classify the site as malicious, including two tier-one security vendors. An external blacklist is also active and independently caps the assessment. The presentation fits a familiar lure pattern: a stablecoin "transfer hub" with a wallet-branded title, hosted on a throwaway subdomain. The evidence does not show a conflict between named legal entities or a confirmed copy of a specific brand. The risk rests on the blacklist and malicious-detection findings, not on identity contradictions. Four abuse reports exist against one of the site's network addresses. Those reports relate to a shared provider address used by many tenants, so they are weak corroboration and are not attributed to this site alone. In the automated browsing sessions, the page made no outbound calls, triggered no wallet-connection prompts, hidden forms or clipboard writes, and showed no cloaking. This does not offset the detection record. A page with this little content can be altered quickly to add a drainer or credential form, and the current behaviour is no guarantee of future behaviour. Evidence:
- Homepage: titled "Transfer Trust Wallet", with only a few dozen characters of visible text and no description of the service.
- Reputation checks: 13 engines rated the site malicious and 2 suspicious, with 2 tier-one security vendors among the flaggers; an external blacklist is active.
- Browsing sessions: 3 of 3 runs succeeded with zero external requests, zero console errors and no wallet-connect or clipboard activity.
- Shared network address: 4 abuse reports on a provider-operated address, classed as shared infrastructure.
Regulatory Verification Notes
The homepage names no legal entity, licence, registration number, jurisdiction, terms of service or privacy policy. For a service that implies handling stablecoin transfers, that is a significant disclosure gap. The site presents no money-transmission or virtual-asset service-provider authorisation. The gap sits alongside the blacklist finding and supports the cautionary reading. No third-party broker or regulatory-database entry was matched for this site, so no external licensing context exists either way. Real-world operator identity cannot be tied to any person or company from the available evidence. The valid transport-encryption certificate is held by the hosting platform, not by an operator of this site, so it confirms an encrypted connection and nothing about who runs the page. Evidence:
- Homepage: no company name, address, licence reference, legal pages or contact details are published.
- TLS certificate: issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1, organisation-validated (OV), subject organisation Netlify, Inc, valid to 2027-03-19.
- Hosting: served from AS16509 (AMAZON-02, Amazon.com, Inc., US).
What to Verify Next
Any interaction with this site should first be tested against independent sources, not against the site's own claims. If someone directed a user to this page, the sender and the instruction should be confirmed through a separate, trusted channel. Before any asset movement is considered, the intended service provider should be identified from an official, independently sourced list and checked against the relevant financial or virtual-asset regulator's public register. If a wallet application is involved, it should be obtained only from the publisher's official listing, not from this page. Any official support or contact channel should be confirmed offline. Evidence:
- Homepage: lacks any named operator that could be searched in a licensing register.
- Reputation findings: the site's detection record should be rechecked against current threat-intelligence sources before any reconsideration.
- Hosting: the page sits on a free, shared subdomain, so the site name alone proves nothing about who controls it.
Summary Verdict
The assessment is critical, with a clearly high-risk posture driven by confirmed blacklist and malicious-detection findings that no other signal offsets. The technically clean behaviour observed and the valid certificate are real but secondary, and they do not establish legitimacy. Operator identity remains unverified, and the site is best treated as a probable credential- or asset-harvesting lure.
Infrastructure Integrity
The site is served through Amazon's cloud edge network, and every observed address is an edge node, so the origin server cannot be seen. Edge-only visibility prevents independent verification of where the content actually resides and can mask rapid content swaps. The platform's protections and the valid certificate are mitigating factors only. They cannot offset the reputational findings, and they make the hosting provider an abuse-reporting channel, not a mark of legitimacy.
Closing Assessment
The site should be treated as read-only at most, and ideally avoided altogether. No login, credentials, wallet connection, seed phrase or funds should be provided to it. Anyone who has already interacted with the site should move remaining assets to a fresh wallet and change reused passwords. The page can be reported to the hosting platform's abuse team and to the relevant phishing-reporting services.
Written analysis generated 2026-10-26 by the TrustSniffer Analysis Engine from the evidence in this report.
What the analysis found
3 findings contributed to this verdict, raised by governance, external reputation, registration and ownership.
01 Governance
- A threat feed lists this domain as malicious, and that caps the score whatever the other checks found.Governance
rule:GOV_CRITICAL_BLACKLIST
02 External reputation
- An external threat feed lists this domain: either Google Safe Browsing marked it malicious, or a significant number of malware engines flagged it.External reputation
rule:EXT_BLACKLIST_CRITICAL
03 Registration and ownership
- The public registration record for this domain is incomplete.Registration and ownership
rule:KF_WHOIS_INCOMPLETE
Signals weighed against the site
- AbuseIPDB: 4 reports on hosting IP 2a05:d014:58f:6200::258 (Amazon Data Services Ireland Ltd, Content Delivery Network), 1% confidence. The reports are attributed to shared infrastructure, not specifically to this website.
Identity verification
| Status | UNKNOWN |
|---|---|
| Identity score | 50/100 |
| Identity verification confidence | 30% |
- AI page analysis unavailable (page captured; identity not AI-verified)
Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence.
What TrustSniffer observed
First-party facts recorded during the assessment of usdttransferhub.netlify.app.
- The request stayed on usdttransferhub.netlify.app. It was not redirected to another domain. Clear
- It is hosted on AMAZON-02, from a server in US. Noted
Domain intelligence
| Registrar | Not available |
|---|---|
| Hosting | AMAZON-02 - Amazon.com, Inc., US |
| Country | US |
| Server IP | 2a05:d014:58f:6200::258 |
| Name servers | Not available |
| CDN / edge network | Detected (aws) |
| Resolved IP addresses | 4 |
| Edge IP addresses | 4 |
| Likely origin IP addresses | 0 |
| SSL issuer | DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
| SSL expiry | 2027-03-19 |
| Domain age | Not available (no registration date was returned) |
| Domain expiry | Not available |
| Archive first seen | Not available |
| Archive snapshots | 0 |
| Reputation | VirusTotal: 13 flagged | AbuseIPDB: 1% confidence, 4 reports | Google Safe Browsing: 0 matches |
About this assessment
A trust score summarises the evidence TrustSniffer could collect about usdttransferhub.netlify.app at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.
TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.