Is portswaps-hub.xyz a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a single-page crypto-style landing site titled "Port Swap — Claim Your Rewards" on a recently created ".xyz" domain. Its captured homepage carries only a very small amount of text. The name and the reward-claim headline suggest a token-swap or rewards-claiming front end, but the captured content does not describe any product, operator or terms. Its apparent purpose is to draw visitors into a "claim" action.

Scam/Impersonation Risk

Contradictory signals are present, and this is the decisive part of the assessment. The domain is blacklisted: more than a dozen independent security engines classify it as malicious, and a further two rate it suspicious. The flagging engines include several tier-one endpoint-security vendors, and an external blacklist listing corroborates them. The site's reputation is therefore not in dispute. Its content also fits the pattern of reward-claim lures that are commonly used to push visitors toward wallet or credential actions. The headline promises rewards to be "claimed", and the page gives no verifiable operator, product description or terms to justify that promise. The domain name combines generic swap and "hub" wording, which is typical of throwaway crypto-lure domains. No confirmed impersonation of a named brand and no conflicting legal identities were observed, so the risk comes from the external threat detections, not from an identified copied brand. The automated browsing sessions saw no external requests, wallet-connection prompts, clipboard manipulation or cloaking. That shows the page was benign in the captured state, but it does not offset the detections and does not rule out content being changed later. Evidence:

• Homepage: titled "Port Swap — Claim Your Rewards", with very little visible text and no product, operator or terms information.
• Domain provenance: registered 2026-08-26 through Namecheap (~0.16 years, about two months old), so the domain has no meaningful operating track record.
• Web archive: 3 snapshots, all from 2026 (first captured 2026-09-11, last 2026-09-22; 1 year tracked), which confirms a brand-new and thinly documented presence.
• Reputation: a large majority of malicious verdicts from tier-one security vendors, plus an external blacklist hit, on the site's own domain.

Regulatory Verification Notes

The captured site shows no legal entity, registration number, licence reference, jurisdiction or compliance statement. The page is a single short screen with no visible terms, privacy or about content. For a site inviting reward claims or swaps, that is a disclosure gap, but it is a verification matter and is not the basis of the adverse conclusion. No third-party broker or regulatory-database match was found for the site. This is an absence of information, not a clearance. The real-world operator has not been independently connected to any person or company. Nothing on the page can be treated as evidence of authorisation to offer swap, reward or token-distribution services. Evidence:

• Homepage: no company name, licence number, registry reference or jurisdiction is stated.
• Legal pages: no terms, privacy or risk disclosures were found in the captured content.
• Hosting: served from AS13335 (Cloudflare, Inc., US).
• Transport encryption: TLS certificate issued by WE1 (domain-validated, DV), valid to 2027-01-22. DV certification confirms only control of the domain, not the operator's identity.

What to Verify Next

Because the site is blacklisted, verification should aim to establish whether any legitimate service stands behind the name. It should not aim to qualify the site for use. Anyone who reached the site through a message, advertisement or social-media post should treat the source as suspect and trace it. Any claimed link to an established swap or rewards program should be checked by finding that program's official channels independently, not through this site. Wallet addresses, token contracts and reward claims presented here should be checked against the claimed project's published documentation. Official support and contact channels should be confirmed through an independent route. If a wallet was connected or credentials were entered, approvals should be revoked and credentials rotated. Evidence:

• Homepage: the "Claim Your Rewards" call to action has no named issuer or program to verify against.
• Domain registration: a domain created about two months before analysis, with no archived history to compare against a claimed brand.
• External detections: multiple vendor flags indicate the address should be reported and tracked, not tested.

Summary Verdict

The site carries an elevated, high-risk posture. Confirmed blacklisting by multiple security engines is decisive. The very recent domain, thin content and absence of any verifiable operator reinforce it. The clean browsing behaviour observed in the captured state is not enough to change this classification.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and WAF, and all observed addresses are Cloudflare edge servers. The origin server was not observable. The certificate is valid and issued by a known authority. These are mitigating technical hygiene factors only. Cloudflare fronts legitimate and malicious sites alike, so the infrastructure offers no assurance about the operator. It also cannot offset the threat detections, and it means the underlying content could be swapped without any change in the visible hosting.

Closing Assessment

The site should not be used for login, wallet connection, credential entry or any financial interaction. If it must be examined, that should be done only from an isolated environment without connecting a wallet or entering personal data. The link or message that led to it should be reported to the relevant platform or to the security team.