Is revenueworking.com a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

Revenueworking.com is a single-page crypto cash-out service branded "Revenue." It invites visitors to sign in with X, send US dollars through X Money to one personal handle, and receive USDC, USDT, SOL or ETH in a self-supplied wallet. The page pairs this conversion service with a sign-in welcome bonus, invite-based referrals, a promoted "$REV" token and a live ticker of large payout notifications. Its apparent business model is fee-based, custodial fiat-to-crypto conversion with a recruitment-style incentive layer.

Scam/Impersonation Risk

This is a clearly cautionary, high-risk assessment. The domain is blacklisted by an external threat-intelligence source, which is a confirmed contradiction, and the site's own mechanics reinforce it. The homepage requires payment before any service is delivered. Funds go to a single personal X handle (@RevenuePay) rather than to a corporate account or escrow, and payouts are described as "sent by hand." The fee is 2% plus $0.50 per order, with a stated ceiling of $20,000 per swap. Because the operator holds the funds, any failed or withheld payout leaves the user with little recourse. The homepage shows a rolling feed of payout notices ("sent you $18,000," "$9,500," "$12,500") that appear seconds apart and cannot be independently verified. The same page labels money payouts as "opening soon." That is a claim-to-evidence mismatch and is consistent with fabricated social proof. The welcome bonus of $20–$600, tied to X sign-in, adds a lure. Invite codes and member numbers count referrals on a personal "card," and no payout mechanics are given for either. The $REV token with a "snapshot is live" banner suggests an airdrop-style hook. A wallet-connect prompt and a sign-in-gated bridge sit in front of the service. The wallet-address field and the order form submit to a destination the analysis did not consider trustworthy. No brand impersonation or conflicting legal identities were observed, so the risk comes from the blacklisting and the service design, not from imitation of another company. Evidence:

• Homepage: payment instructions direct all USD to one X Money handle, with payout described as manual and the service stated as pay-first.
• Homepage: a live payout ticker with large, rapidly rotating amounts, while the same page marks money payouts as "opening soon."
• Homepage: a welcome bonus of $20–$600, invite codes, member numbers and a $REV token promotion with no verifiable mechanics.
• Domain provenance: registered 2026-10-06 (~0.04 years old, about two weeks), with only 3 archive snapshots, all between 2026-10-06 and 2026-10-14 (1 year tracked).

Regulatory Verification Notes

No legal entity, licence, registration number, physical address or custody arrangement appears anywhere on the site. This is a material gap for a service that takes custody of user funds and converts them between fiat and crypto. Operator identity could not be connected to any real-world person or company, and ownership details are opaque. That opacity is an administrative finding and is not by itself an identity contradiction. No third-party broker or regulatory-database record was matched, so no external licensing signal exists either way. The transport encryption is a basic domain-validated certificate, which proves only that the connection is encrypted and says nothing about who operates the site. The risk conclusion here rests on the confirmed external listing and the page's own custodial and pay-first design, not on the missing disclosures alone. Evidence:

• Homepage and footer: no company name, licence, address or custody details are published, and the only contact route is a Telegram channel.
• Registration: domain registered through NICENIC International Group Co., Limited, created 2026-10-06 and expiring 2027-10-06.
• Transport security: DV-level TLS certificate issued by YE1, valid to 2027-01-04.
• Hosting: served from AS13335 (Cloudflare, Inc., US).

What to Verify Next

Before any engagement, the operator should be asked to prove a real legal identity and a regulatory authorisation for custodial currency conversion, checked directly against the relevant national financial-services registry and not through any claim on the site. The official support and contact channels should be confirmed through an independent route, not through links on the page. The X account behind the payment handle should be checked for age, history and any history of complaints or impersonation. The payout feed and the welcome-bonus terms should be treated as unproven until supported by independent user reports or an auditable record. Anyone who has already sent funds or connected a wallet should preserve order identifiers and transaction records and review the wallet's approved permissions. Evidence:

• Homepage: the payment recipient is an individual X handle, so account age and history can be checked on the platform itself.
• Homepage: order codes (format "RV-…") and a payout feed are shown, so a user holding one can request a transaction reference for verification.
• Homepage: a wallet-connect prompt is present, so wallet permissions should be reviewed after any interaction.

Summary Verdict

The overall posture is critical-risk and clearly cautionary. A confirmed external listing converges with a custodial, pay-first, unverifiable operating model and a very recently created domain. Neither the infrastructure hygiene nor the technically clean on-page behaviour offsets that convergence. Legitimacy cannot be inferred from the site's presentation.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and WAF, and all four observed addresses are edge servers. The origin host was not observable. This protection is a mitigating factor only. It provides no assurance about who operates the site, and edge-only visibility prevents independent verification of the underlying host and can mask rapid content changes. A young domain with sparse subdomains is a minor, unconfirmed heuristic and adds only marginal weight.

Closing Assessment

The site should not be used for login, wallet connection, payment or any financial transaction. Anyone who has already interacted with it should stop further transfers and revoke any wallet permissions granted. They should also report the service to the relevant platform and consumer-protection channels.