Is xamportal.info a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

xamportal.info is a recently created website whose homepage, when visited by an automated analysis browser, returned a security interstitial rather than ordinary site content. The only page text captured was a short block, and its title was a suspected-phishing warning. The site's purpose and business model cannot be read from the content captured, because the page that loaded was a protective challenge rather than a branded product or service page.

Scam/Impersonation Risk

Active contradictions are present and are the decisive element of this assessment. The domain is currently blacklisted by external threat-intelligence sources. A large number of detection engines classify it as malicious, including several tier-one security vendors, and this alone places it in the most severe reputational category. The finding is a confirmed external listing, not an unattributed rumour. It is reinforced by the captured homepage, which was a warning-style interstitial naming suspected phishing. No competing legal identity or explicit brand impersonation was established from the content that could be captured, but that reflects how little of the site could be read. It does not offset the external listings. Browser behaviour adds context without changing the conclusion. Across three sandbox runs the site generated heavy third-party traffic, with most requests going to external hosts, many background and form-submission calls to outside destinations, and a high volume of script errors. No wallet-connection prompts, clipboard tampering, hidden forms, or credential posts to external hosts were observed. The site is also very young, and the combination of a new domain and confirmed malicious listings is the pattern typical of disposable or abusive infrastructure. As a contact-channel check, no email address or other contact artifact could be extracted from the page content. Evidence:

• Homepage: the captured page carried a suspected-phishing interstitial title, and its content was blocked behind a bot challenge with an access-denied response.
• Reputation checks: multiple independent threat-intelligence sources currently flag the domain as malicious, which triggered the strictest reputational override.
• Domain registration: created 2026-08-17 and about 0.19 years old, which is far too young to have built any independent reputation.
• Sandbox behaviour: 37 external background requests, 9 external POST requests, and 26 console errors across 3 runs, with roughly 96% of requests at peak going to external destinations.

Regulatory Verification Notes

No legal, licensing, or registration disclosures could be assessed. The only page content obtained was the interstitial, so there were no terms, about, or legal pages to read. No third-party regulatory source confirms the site, and no broker-reputation record matched it. The site shows no verifiable corporate identity, and the registration details are incomplete, which amounts to ownership opacity. That opacity is an administrative limitation in its own right. It is not an identity contradiction, because no conflicting legal entities were found. The technical posture is ordinary for a basic website: a valid encrypted connection from a domain-validated certificate, which proves only control of the domain and says nothing about the operator's identity or intent. The identity of the real-world operator remains unverified. Evidence:

• Domain registration: registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on 2026-08-17, expiring 2027-08-17, with owner details incomplete.
• Transport encryption: TLS certificate issued by WE1 (DV), valid to 2027-01-14.
• Hosting: served from AS13335 (Cloudflare, Inc., US).
• Third-party broker records: no match, so no external regulatory or broker verdict exists to rely on.

What to Verify Next

Verification steps are secondary here, because the confirmed blacklisting already makes the site unsuitable for sensitive interaction. Any party that still needs to establish what the site is should rely on independent routes. Examine its content only from an isolated, disposable environment. Check whether any organisation claims the domain as its official address through that organisation's own known website or an offline channel. If the domain was received in a message, advertisement, or invoice, confirm with the supposed sender by a separately sourced phone number or address. Re-check the external listings after some time, since a changed listing would be the only basis for reassessment. Evidence:

• Homepage: only a protective interstitial was returned, so no on-site claim of identity, product, or licence exists to confirm.
• Reputation checks: the current external malicious listings are the baseline against which any later re-check should be compared.
• Domain registration: the roughly two-month-old registration has no established history that could substitute for independent confirmation.

Summary Verdict

The overall posture is high-risk and clearly cautionary. Confirmed external blacklisting, a very recent domain, and an unverified operator converge on an assessment that rules out treating the site as legitimate. The evidence found no mitigating factor strong enough to support a neutral reading.

Infrastructure Integrity

The site is delivered through a mainstream CDN and WAF provider, with all observed addresses belonging to its edge network and no origin server visible. A valid certificate from a recognised issuer and a healthy interaction response also appeared in testing. This is a mitigating factor only. The edge-only visibility prevents independent verification of where the content is actually hosted, and the protection cannot offset the reputational findings. The bot challenge that blocked content capture is consistent with this protective layer.

Closing Assessment

The site should not be used for login, credential entry, payments, or any financial or personal-data interaction. Passive, read-only viewing from an isolated environment is the most that is defensible. Any link to it received in a message should be treated as hostile and reported.