Skip to content
Scammers.com
PhishingReviewed

Phishing alert: amount-to-usdt-seven.vercel.app fake Trust Wallet USDT page

The phishing-alert account @TheThreatWire posted on X on 10 November 2026 (Phishing Alert #129) that hxxps://amount-to-usdt-seven.vercel.app/ is a phishing page impersonating Trust Wallet, the cryptocurrency wallet. v…

First reported
Reports
1

Source: x.com · published

Screenshot of a look-alike Trust Wallet PIN page on a Vercel subdomain
Image: @TheThreatWire (via X)

What happened

The phishing-alert account @TheThreatWire posted on X on 10 November 2026 (Phishing Alert #129) that hxxps://amount-to-usdt-seven.vercel.app/ is a phishing page impersonating Trust Wallet, the cryptocurrency wallet. vercel.app is a shared hosting domain; only this subdomain is reported here, and Vercel and Trust Wallet are not the operators. Never enter a wallet recovery phrase or approve a transaction on a site reached from a link, and use only the official Trust Wallet app.

How the scam works

Trust Wallet look-alike pages often appear in messages, ads or comments that promise a USDT or other token credit and then ask you to connect a wallet or type a recovery phrase. The address amount-to-usdt-seven.vercel.app is a page on shared Vercel hosting, not an official Trust Wallet site. Anyone who obtains a recovery phrase can empty the wallet, and a connected wallet can be tricked into approving a harmful transaction.

Never enter a recovery phrase on a website, and never approve a transaction because a page reached from a link asked you to. Use only the official Trust Wallet app. Only this vercel.app subdomain is reported here; Vercel and Trust Wallet are not the operators. The alert comes from a public tracker post and has not been independently checked by scammers.com.

A USDT or other token credit that can be claimed only after you visit a vercel.app page is not a genuine wallet feature. Official wallet support will not ask you to type a recovery phrase into a browser form.

Source

Public post on X, 10 November 2026: https://x.com/TheThreatWire/status/2120048280046633046

The indicators come from this source and have not been independently checked by scammers.com.

Red flags

  • A sign-in or account page whose address is not the official Trust Wallet app.
  • A message, ad or email that urges you to sign in through a link to fix a problem or claim a reward.
  • A request for your password, one-time login code or recovery phrase on a page you reached from a link.
  • A brand name in the address or on the page that does not match the company's real website.
  • A request for a wallet recovery phrase or a transaction approval on a website.

If you were targeted

  1. 1Never enter a wallet recovery phrase or approve a transaction on a site reached from a link.
  2. 2Use only the official Trust Wallet app, installed from an official app store.
  3. 3If you entered a phrase or approved a transaction, move remaining funds from a new wallet created on a clean device.
  4. 4Report the link to Trust Wallet through its official channels and to a national cyber reporting service.
  5. 5Delete the message without replying or tapping any links.
PhishingReviewed

GMX.net email login phishing page at xncok12.weebly.com

PhishDestroy posted on Mastodon on 12 November 2026 that xncok12[.]weebly[.]com is a phishing page. Its record describes a GMX.NET-branded email and password login form, flagged by 17 of 92 VirusTotal engines. GMX is…

  • xncok12.weebly.com
  • Weebly subdomain; VirusTotal 17/92
Reported Nov 12, 20261 report
PhishingReviewed

Fake STP / SPEI login page at portal.stpmex.br.com flagged as phishing

The phishing feed @PhishStats posted on X on 12 November 2026 a new phishing URL, hXXps://portal[.]stpmex[.]br[.]com/spei/login/, hosted at 217.151.99.216 (M247 Europe SRL, AS9009, Romania). The hostname and path use…

  • portal.stpmex.br.com
  • Path /spei/login/; IP 217.151.99.216 (M247 Europe, AS9009, Romania)
Reported Nov 12, 20261 report