new-click-app-99.surge.sh
Category: Phishing
To use full-featured product, you have to purchase a license for Combo Cleaner. Limited seven days free trial available. Combo Cleaner is owned and operated by RCS LT, the parent company of PCRisk.com.
Description of new-click-app-99.surge.sh
This domain appears to host a simple web application presented as a cryptocurrency transfer interface. The page title, "Transfer Trust Wallet," and the visible form fields suggest it is intended to facilitate or simulate sending USDT on Binance Smart Chain, with inputs for a wallet address or domain name and transfer amount.
Based on the screenshot and metadata, the site does not appear to represent a full corporate website or established financial platform. Instead, it looks like a lightweight single-page app deployed on a Surge subdomain, which may indicate temporary or low-cost hosting rather than an official branded service. No clear operator identity, company details, or supporting business information are visible from the provided scan data.
Safety Assessment for new-click-app-99.surge.sh
The scan results indicate elevated risk signals at the time of this scan. The domain was flagged by 10 out of 91 security engines, with multiple detections classifying it as phishing-related. In addition, the page presents itself as a Trust Wallet-related transfer tool while using an unrelated Surge subdomain, which may increase the likelihood of misleading branding or credential/asset-harvesting behavior. Although the malware scan did not identify malicious files, phishing pages often rely on deceptive page content rather than downloadable malware.
Blacklist data was mixed rather than fully clean: major content-focused threat databases in the provided results did not detect a threat, but the domain's IP address is listed on one mail-reputation blocklist. That type of listing is a weaker signal for website content risk on its own, but it adds a small amount of caution when combined with the phishing detections and the page's wallet-transfer theme.
Taken together, the combination of multi-engine phishing flags, the crypto-transfer presentation, and the lack of visible operator transparency suggests this website may pose potential risks to visitors at the time of this scan.
Technical Description
The site is served over HTTPS with a valid TLS certificate issued by Sectigo Limited, expiring on 2026-12-16. It is hosted on Surge infrastructure, with the server IP resolving to DigitalOcean in Frankfurt am Main, Germany. The domain uses Surge nameservers and appears to be deployed as a hosted subdomain rather than a standalone business web property.
DNSSEC is unsigned, which is common but provides no additional DNS integrity protection. No malicious files or flagged external links were identified in the provided page scan, and the page appears to load a small set of static assets plus a JavaScript library for blockchain interactions. The main technical concern is therefore not exploit delivery, but the possibility that the page's functionality and branding may be used in a deceptive manner.
Share your experience with this website. Was it safe? Did you encounter any issues?