Is revenuepays.com a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

Revenue is a newly launched crypto-conversion landing page that presents itself as a bridge for cashing out X Money balances into digital assets. A visitor is asked to sign in with X, send US dollars to a single X handle, and receive USDC, USDT, SOL or ETH at a pasted wallet address. The apparent business model is a fee-based custodial payment intermediary, supplemented by an invite-driven membership scheme and a promotional token.

Scam/Impersonation Risk

No formal contradictions were observed: there is no confirmed phishing finding, no conflicting legal identities, and no identified impersonation of a specific brand. The risk lies in the structure of the offer, which is serious. On the homepage, customers must pay first. The funds go to one individual-style handle rather than a corporate payment account, and the payout is described as manual, so the operator holds the customer's money before any crypto is delivered. The stated fee is 2% plus $0.50. The page's own illustrations do not reconcile: a $20.00 order shows 19.10 USDC received, while the swap panel shows a $20.50 fee against 979.50 USDC received. The page advertises a scrolling "payout notifications" feed with figures from $900 to $18,000 and second-by-second timestamps, while the same section is labelled "opening soon". The feed cannot be verified and has the hallmarks of fabricated social proof. The homepage also promotes a locked welcome bonus, invite codes and member numbers that reward recruitment, and a $REV token with a "snapshot is live" banner. These features resemble referral-driven token promotions rather than a conventional payments service. The only community channel is a Telegram link, and the page uses X's branding without any evident authorisation. The sandbox runs found no wallet-drainer behaviour, clipboard tampering, hidden forms or external data posting. That limits the technical exposure, but it does not offset the financial-conduct concerns. One threat-intelligence engine has also flagged the domain as a soft reputational signal. It is not a confirmed listing, and what it detected was not specified. Evidence:

• Homepage: users pay a single X handle first and receive crypto after a manual payout, with the fee and the sample amounts inconsistent with each other.
• Homepage: a payout feed showing large sums is labelled "opening soon", and a locked welcome bonus, invite codes and a $REV token are promoted without any verifiable reserve.
• Domain registered 2026-10-04 (~15 days old, ~0.04 years); the web archive holds 2 snapshots, both captured on 2026-10-04, so the site has effectively no history.
• The domain does not appear in the DeFiLlama protocol directory, and no on-chain reserve or audit is presented.

Regulatory Verification Notes

The site presents no legal entity name, registered address, licence, registration number, reserve statement or audit, and it has no separate terms, privacy or about pages that could carry such disclosures. It takes custody of customer funds and converts fiat value to digital assets, which is a regulated activity in many jurisdictions. For a service of this kind, the absence of any disclosure is a material verification gap rather than a minor omission. The registrant and operator identity could not be independently connected to a real-world person or company. No third-party broker or regulatory listing matched the domain, so there is no external reputational record to weigh in either direction. The technical credentials are ordinary and do not establish legitimacy: the domain uses a basic domain-validated certificate and was registered through a low-profile registrar. Evidence:

• Homepage: no company name, licence authority, registration number or physical address is displayed; the only contact route is a Telegram link.
• Domain registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, with registration running to 2027-10-04.
• TLS certificate issued by YE1 (DV, domain validation only), valid to 2027-01-02 (74 days remaining at analysis).
• Served from AS13335 (CLOUDFLARENET - Cloudflare, Inc., US).

What to Verify Next

Before any funds move, the operator should be asked to produce a legal entity name, jurisdiction and the money-services or virtual-asset-service-provider registration that covers custody and conversion. That claim should then be checked directly with the named regulator's public register. The payout feed should be tested against independent evidence, such as on-chain transactions to wallets whose owners can be corroborated, because the on-page notifications offer no proof. The X handle's account age, ownership and history, along with the Telegram channel's membership, should be examined for signs of a recently created or coordinated promotional operation. The official support channels should be confirmed through an independent route rather than through links on the page. Any claim of a reserve, audit or token allocation for $REV should be validated against public blockchain data before it is relied on. Evidence:

• Homepage: the stated service terms (fee, manual payout, bonus unlock) have no published terms of service to anchor them.
• Homepage: the $REV token and the wallet addresses shown in the sample order can be checked against public blockchain explorers.
• Homepage: the single external link points to a Telegram channel, so there is no other documented channel to cross-check.

Summary Verdict

The available evidence supports an elevated-risk assessment. A brand-new domain pairs a custodial, pay-first fiat-to-crypto service with unverifiable claims and promotional mechanics. No specific scam has been confirmed, and no operator identity has been established. The site is therefore not demonstrated to be legitimate, and the deterministic assessment is clearly cautionary.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and web application firewall, and all observed addresses are edge servers, so the origin host was not visible. The certificate is valid. These are mitigating factors only: they provide transport protection and some resilience against attack, but they say nothing about who operates the site or how customer funds are handled. Edge-only visibility also means that content can be swapped quickly without any change in the hosting footprint. The domain's very recent creation with sparse subdomains is an unconfirmed heuristic, but it matches the early-stage profile seen elsewhere in this assessment.

Closing Assessment

Until the operator's identity, licensing and fund handling are independently confirmed, the site should be treated as unsuitable for sign-in, wallet connection or payments. Any contact with it should be limited to viewing the page. Anyone who has already sent funds or authorised access should preserve the order references and transaction records and consider reporting the matter to their payment provider and the relevant consumer-protection authority.