Is axiomprotocols-rlusd.info a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Google, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a single-page promotional site titled "Axiom Protocol × RLUSD — Priority Allocation Program". It uses a crypto-themed name that pairs a protocol brand with a stablecoin ticker, and it presents an "allocation" program to visitors. The apparent purpose is to solicit participation in a token or asset distribution scheme. Its domain structure and framing are typical of campaigns that attract users with the promise of early or priority access.

Scam/Impersonation Risk

Material contradictory signals are present, and the posture is clearly cautionary. Several independent threat-intelligence sources currently list the domain as malicious, including the browser-protection service run by a major search provider. That service classifies the threat as social engineering, meaning the site is judged to deceive visitors into harmful actions. Four tier-one security vendors also flag it, and a large number of the engines that scanned it returned malicious verdicts. The site is therefore blacklisted, and this finding is decisive. The domain name chains a protocol brand to a stablecoin ticker, and the page promotes a "priority allocation". This is a recognised lure pattern in which users are pulled toward claiming allocations, connecting wallets, or submitting data. No conflicting legal entities were observed. Sandbox testing did not observe a wallet-connection prompt, clipboard manipulation, or cloaking. Those clean results do not offset the external listings. The site's runtime behaviour adds a secondary concern: about two-thirds of its network activity went to external destinations. Three data submissions were sent to third-party endpoints outside the commonly trusted set, and the page logged repeated console errors. Data entered on the page could therefore leave the site's own domain. Evidence:

• Homepage: the title promotes a "Priority Allocation Program" that links an unverified protocol name to the RLUSD stablecoin ticker.
• Reputation checks: the domain is blacklisted by the search provider's browser-protection service and by other threat-intelligence sources, with a social-engineering classification and four major security vendors flagging it.
• Sandbox behaviour on the homepage: three outbound submissions to non-whitelisted third-party destinations across three runs, with 66.7% of observed requests going to external hosts.
• Domain registered 2026-06-04 (~0.4 years old) through NICENIC INTERNATIONAL GROUP CO., LIMITED, with 3 archive snapshots spanning 2026-08-10 to 2026-09-22 (1 year tracked).

Regulatory Verification Notes

The captured page gave no clear evidence of a licensing statement, registered-entity name, or regulatory authorisation. Its disclosure position is therefore unclear. The distribution of an "allocation" tied to a stablecoin brand would ordinarily call for such disclosure. This is a transparency gap that cannot establish legitimacy, and it does not by itself prove wrongdoing. Real-world operator identity could not be independently connected to any known brand or person, so no legitimacy claim can be supported. The registration details are incomplete, which is consistent with ownership opacity and is an administrative limitation rather than an identity contradiction. No third-party broker or regulatory listing matched this site. The valid certificate and mainstream hosting do not substitute for the missing disclosures. Evidence:

• Homepage: no identifiable legal entity, licence, or registration reference was found in the captured content.
• Hosting: served from AS13335 (Cloudflare, Inc., US) under the ARIN registry.
• Transport encryption: TLS certificate issued by WE1 (DV, domain-validated only), valid to 2026-12-29. This confirms encryption only and says nothing about operator identity.
• Registration record: owner details are incomplete, and the registrar is NICENIC INTERNATIONAL GROUP CO., LIMITED.

What to Verify Next

Any claim of affiliation with the named protocol or with the stablecoin issuer should be checked only through those organisations' official channels, reached independently of this site. Any "allocation" or "priority" offer should be treated as unconfirmed until the protocol team confirms it through its own verified announcements. The operator's claimed legal entity and any licence should be checked against the relevant public registry. The operator's contact channels should be confirmed by an independent route. Anyone who has already interacted with the site should assume any information entered may have been exposed. Evidence:

• Homepage: the program name and branding are the claims to confirm with the named organisations.
• Reputation checks: the active social-engineering classification means prior interaction should be treated as potentially compromising.
• Registration record: the site is only months old, so there is no long operating history to rely on.

Summary Verdict

The available evidence indicates an elevated-risk website with decisive negative reputation signals. Its infrastructure and technical hygiene are ordinary and do not mitigate those signals. The site's identity remains unverified, and the evidence does not support treating it as legitimate.

Infrastructure Integrity

The site sits behind a trusted CDN/WAF provider, and all four observed addresses are edge servers. The origin server was not observable. This is a mitigating factor only, and it does not offset the external threat listings or establish legitimacy. Edge-only visibility prevents independent verification of the true hosting location. It can also mask rapid content changes, which is relevant given the site's reputation status.

Closing Assessment

The site should not be used for sign-in, credential entry, wallet connection, or any financial interaction. Any visit should be limited to passive viewing, ideally in an isolated environment. Users who have already submitted data should change affected credentials and review wallet and account activity.