Is xamanvoting.com a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website, xamanvoting.com, is a recently registered domain behind a Cloudflare protection layer. When analysed, its homepage returned only a "Just a moment..." bot-verification interstitial, so no product, service, or business description reached the analysis. Its apparent purpose and business model therefore cannot be established from the site itself, and the page presented no verifiable operator or service claims.

Scam/Impersonation Risk

Confirmed adverse contradictions are present. The domain is currently flagged as malicious by a substantial cluster of independent security engines, including several tier-one security vendors, and it also carries a confirmed external blacklist listing. These detections are the decisive factor in the assessment. No identity contradiction, brand impersonation, or phishing content was independently confirmed, and no conflicting legal entities were observed. The blacklist nonetheless represents a direct, current threat-reputation signal, and the very young domain with almost no historical footprint offers no track record to offset it. A set of abuse reports exists against one of the site's Cloudflare edge addresses. Those reports relate to shared provider infrastructure used by many unrelated customers, so they were discounted and not attributed to this site. Behavioural testing found no wallet-connection prompts, clipboard manipulation, hidden forms, external password forms, or fingerprinting. All third-party network traffic went to recognised destinations. This is a mitigating observation, but it does not outweigh the confirmed detections, and the bot challenge limited how much page behaviour could be exercised. Evidence:

• Homepage: the domain was registered on 2026-06-11 (~0.38 years old), a very young domain.
• Web archive: 1 snapshot, captured 2026-08-07, spanning 2026 only (1 year tracked), so the site has no meaningful historical continuity.
• Homepage behavioural sessions: all three runs completed, with no wallet-drainer, clipboard-hijack, hidden-form, or external credential-form activity.
• Homepage network activity: heavy third-party request traffic, with most requests being external and a high console-error count, consistent with a challenge-gated, script-heavy front end.

Regulatory Verification Notes

No legal, terms, privacy, or licensing pages were captured. Disclosure state is therefore unclear, and no regulatory registration or authorisation could be associated with the domain. The registration record names an individual registrant and no corporate entity, and real-world operator identity remains unverified. A third-party broker-reputation lookup returned no match. That is neutral context, not a licensing or regulatory finding. Any claim of regulated activity would need independent confirmation with the relevant registry. Nothing in the evidence supports such a claim. Evidence:

• Domain registration: registered through PDR Ltd. d/b/a PublicDomainRegistry.com, with an individual named as owner and no organisation listed; the registration runs to 2027-06-11.
• Hosting: served from AS13335 (Cloudflare, Inc., US).
• Transport security: TLS certificate issued by WE1 at domain-validated (DV) level, valid to 2027-01-05. A valid certificate confirms only encryption in transit, not operator legitimacy.
• Homepage: the only content captured was a verification interstitial, so no on-page identity, licensing, or company disclosures could be assessed.

What to Verify Next

Before any engagement, confirm through an independent route, such as an official channel of the organisation the site claims to represent, whether this domain is genuinely theirs. Re-check the domain's threat-reputation status later, since a listing on a compromised or newly deployed site can be cleared only after remediation. Establish the operating entity behind the domain through a corporate registry, not through anything the site says about itself. If the site claims any regulated financial or digital-asset activity, confirm that authorisation directly with the relevant regulator's public register. Also confirm the official support and contact channels independently. Evidence:

• Homepage: no operator or purpose claims were available to compare against independent sources, so every identity link remains unconfirmed.
• Registration record: the registrant of record is an individual, which makes a corporate-registry check the logical first step.
• Threat listings: the current detections are recent, so a later re-check can show whether the listing persists or is resolved.

Summary Verdict

The available evidence supports a high-risk posture. Current, corroborated malicious detections from multiple independent sources dominate the assessment, and the site's youth and absence of any verified operator identity or history leave nothing to counterbalance them. Technical hygiene such as valid encryption and a clean behavioural profile does not change this conclusion.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and WAF. All observed addresses are Cloudflare edge servers, and the origin server was not observable, so hosting cannot be independently verified. Bot protection was active and likely produced the challenge page. This is a mitigating factor for availability and attack exposure only. Protective infrastructure is not evidence of legitimacy and cannot offset the reputation risk. Edge-only visibility also means site content could be swapped quickly without any change in observable hosting.

Closing Assessment

Account login, credential entry, wallet connection, and any financial or payment interaction with this domain should be avoided. At most, passive viewing from a hardened, isolated environment is defensible. Nothing should be downloaded from the site. Organisations should consider blocking the domain at the web gateway and email filter until its reputation is independently cleared.

Signals weighed against the site

• AbuseIPDB: 7 reports on hosting IP 2a06:98c1:3120::1 (Cloudflare, Inc., Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.