Is eligibility-xaman.app a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Google, Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website, whose domain name pairs an "eligibility" prompt with a crypto-wallet-style label, could not be observed directly. The only content captured was a Cloudflare interstitial warning that the requested site had been reported for potential phishing, with an "Ignore & Proceed" button. No products, pricing, account flows, legal pages or contact details were visible, so the site's purpose and business model cannot be determined from the capture. The warning page is the main thing a visitor encounters.

Scam/Impersonation Risk

Confirmed contradictory signals are present, and this is the decisive part of the assessment. Two independent threat-intelligence sources flag the domain as malicious, and a major browser safe-browsing service classifies it under the social-engineering (phishing) category. Together these amount to a confirmed blacklist condition. The content on the destination site could not be inspected, so the specific lure or collection mechanism is unknown. The risk rests on the third-party phishing determination, not on observed page content. The page showed no login form, hidden form or wallet-connection behavior, and no brand impersonation was detected from the captured content. These absences do not offset the blacklist signals, because the real site sat behind the warning page. The domain name combines an eligibility claim with a wallet-style label. That is the kind of wording used in claim or eligibility lures, but it is a naming observation, not a confirmed impersonation. Automated browsing also recorded heavy outbound network activity relative to the page's size, a large burst of page-structure changes after interaction, and a high rate of console errors. These are consistent with an unstable or obfuscated page, but they are secondary to the blacklist signals.

Regulatory Verification Notes

The captured page contains no legal-entity name, licence, registration number, terms, privacy policy or contact information. Because the underlying site was never displayed, this cannot be treated as a considered omission by the operator. It means no on-site disclosure could be assessed. The operator's real-world identity is unverified, and the registration details show ownership opacity. No third-party broker or regulator-style record matched this domain, and no regulated status is indicated. Any claim of regulation or authorization made on the destination site should be treated as unsubstantiated. The valid certificate and recognized infrastructure confirm only that the site is technically reachable and encrypted. They say nothing about who operates it or whether it is licensed.

What to Verify Next

Verification here means confirming independently whether the domain is connected to any legitimate service. It does not mean testing the site. If the domain arrived through a message, advertisement or social post, the sender should be authenticated through an independent, separately sourced channel. The wallet or service named in the domain should be reached only through its official application or a manually typed, known-good address, not through this domain. Any claim of eligibility, reward or claim entitlement should be checked inside the provider's own official channels. Internal security or fraud teams should consider reporting the domain to the relevant brand owner and to phishing-reporting services, and blocking it at the organizational level while the third-party flags remain active. Official support and contact channels should be confirmed through the legitimate provider's own published materials.

Summary Verdict

The domain is assessed as critically untrustworthy and carries a high-risk posture. Multiple independent reputation sources agree on a phishing determination, and the domain is extremely new with no operating history. No offsetting legitimacy evidence exists. The destination's real content and operator remain unknown, so the blacklist signals alone drive the conclusion.

Infrastructure Integrity

The domain resolves entirely to Cloudflare edge addresses in the US. No origin server address was observable, so hosting cannot be independently attributed to the operator. Cloudflare is a reputable provider, and its protections and clean shared-infrastructure abuse record are mitigating context only. Here that protection coincides with the phishing interstitial, and it cannot offset the confirmed reputation risk. The valid but low-assurance domain-validated certificate confirms encrypted transport only.

Closing Assessment

Account login, credential entry, wallet connection and any financial or claim-related interaction with this domain should be avoided. The warning interstitial should not be bypassed. At most, the domain should be treated as a reported threat to block and report, not as a service to engage with, until the third-party flags are independently cleared.