Verdict
This assessment found strong scam indicators. Do not pay, sign in, or share personal details with this site.
xaodaodistro.com shows high-risk / scam indicators.
Evidence status and limitations
Evidence completeness: Not recorded
- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.
At a glance
The checks that decide most of this verdict.
| Malware engines | 3 flagged itVirusTotal | Risk |
|---|---|---|
| Google Safe Browsing | Not listedGoogle | Clear |
| Abuse reports on the host | 0% confidenceAbuseIPDB, 0 reports; shared hosting inflates reports | Clear |
| Domain age | 4 months oldMost scam domains are under a year old | Risk |
| Web archive | Archived since 20261 snapshot | Clear |
| Certificate | Encrypted connectionIssued by WE1 | Noted |
The page as captured
Key findings
- Automated classification: Sensitive Interaction Risk.
- Domain age: less than 1 year (registration continuity).
- Public web-archive history exists since 2026.
- At least one reputation service TrustSniffer consulted had flagged this domain at assessment time.
Full analysis
Security Alert
Fortinet flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.
This website is a single-page promotional site titled as an "XAODAO × Ripple — RLUSD Priority Allocation Program". It presents itself to visitors as a token or stablecoin allocation offer linked to a well-known digital-asset brand. Its apparent purpose is to draw visitors into claiming or registering for a priority allocation. Only one page of content, roughly the length of a short landing page, was captured.
Scam/Impersonation Risk
Contradictory signals are present and are the decisive factor in this assessment. The site is confirmed as blacklisted: external threat-intelligence sources currently flag it as malicious or suspicious, and several independent engines concur rather than a single outlier. The site's framing compounds the concern. The homepage title ties a newly registered domain to a major, recognizable payments and digital-asset brand and to a "priority allocation" offer for a stablecoin. The supplied evidence does not establish any affiliation with that brand. A time-limited allocation offer is a common lure in token-claim and wallet-solicitation schemes. No explicit brand-impersonation or phishing-page finding was returned, and no wallet-connection or clipboard-manipulation behavior was observed in the sandbox runs. Even so, the combination of blacklist status and an unverified brand association places this site in a high-risk posture. Behavioral testing also showed that a large share of the site's network traffic went to external destinations. Several background requests and data submissions went to third-party endpoints outside the common allow-listed services, and the page logged console errors. That pattern fits a thin page that relays visitor input elsewhere. No conflicting legal identities were found, because the captured content names no legal entity at all.
- The domain was registered in 2026 (about 0.32 years old), so it has had under four months to build any reputation.
- The web archive holds 1 snapshot, captured in July 2026 (1 year tracked), so there is no prior history to corroborate a legitimate past use.
- The homepage title links the site to a major third-party brand and a stablecoin "priority allocation" program, with no verifiable supporting evidence.
- Sandbox runs showed 3 data submissions to non-allow-listed external destinations, and about 71% external request activity at peak.
Regulatory Verification Notes
The captured homepage discloses no operating company, registered address, license, or registration number. It offers no regulatory standing for an allocation program that implies financial or digital-asset activity. This is a disclosure gap on the site's own content. On its own it would be a verification item, but here it coexists with the blacklist signal and therefore cannot be treated as neutral. No third-party broker or regulator record matched this domain, which gives no independent reputational support. The site's transport encryption is valid, but a domain-validated certificate confirms only control of the domain and says nothing about who operates it or whether the offer is genuine.
- The homepage lists no company name, license, or registration details.
- The domain registrar is NICENIC International Group Co., Limited, with registration running to July 2027.
- Served from AS13335 (Cloudflare, US).
- The TLS certificate was issued by WE1 (DV), valid to 2026-11-29 (33 days remaining).
What to Verify Next
Any claim of a Ripple-linked RLUSD allocation program should be checked only through the brand's officially published channels, reached independently of this site and not through any link on it. A real program would be announced there. No wallet should be connected, no seed phrase entered, no signing request approved, and no personal or payment details submitted until such confirmation exists. Organizations that encounter this domain in email, messaging, or advertising should treat it as a candidate for blocking or reporting, and should confirm the official support and contact channels offline. If any wallet interaction has already occurred, wallet approvals should be reviewed and revoked.
- The homepage cites a named third-party brand and a stablecoin allocation offer, but supplies no verifiable announcement or source.
- The site was first archived in July 2026, so there is no record of earlier use or announcements.
- The site's own pages disclose no operator or license to cross-check against a registry.
Summary Verdict
The available evidence supports a high-risk posture. Active threat-intelligence listings, a very young domain with almost no history, and a thinly documented offer using a major brand's name converge into a clearly adverse assessment. The site's technical hygiene does not outweigh this. Whoever operates it remains unverified.
Infrastructure Integrity
The site is delivered through Cloudflare's CDN and WAF in the United States, and all four observed addresses are CDN edge nodes. The origin server was not observable. Edge-only visibility prevents independent verification of the true hosting location and can mask rapid content swaps. The CDN is a mitigating factor only. It does not offset the reputation risk, and it is not evidence of legitimacy.
Closing Assessment
The site should not be used for login, credential entry, wallet connection, or any financial interaction. At most, passive viewing is acceptable. Security teams should consider blocking the domain and warning users who may have received the offer.
Written analysis generated 2026-10-27 by the TrustSniffer Analysis Engine from the evidence in this report.
What the analysis found
5 findings contributed to this verdict, raised by external reputation, history in the web archive, hosting and network, behaviour in a sandbox, registration and ownership.
01 External reputation
- An external threat feed lists this domain: either Google Safe Browsing marked it malicious, or a significant number of malware engines flagged it.External reputation
rule:EXT_BLACKLIST_CRITICAL
02 History in the web archive
- The web archive has almost no record of this domain, which fits a site that is new.History in the web archive
rule:ARCH_PEN_YOUNG_AND_SPARSE
03 Hosting and network
- The domain was registered between three and six months ago.Hosting and network
rule:DNS_YOUNG_6M
04 Behaviour in a sandbox
- Most of what the page loaded came from other domains rather than from this one.Behaviour in a sandbox
rule:BEHAV_EXTERNAL_RATIO_HIGH - The page sent data to a destination TrustSniffer does not recognise.Behaviour in a sandbox
rule:BEHAV_NONWHITELISTED_POSTS
05 Registration and ownership
- The public registration record for this domain is incomplete.Registration and ownership
rule:KF_WHOIS_INCOMPLETE
Identity verification
| Status | UNKNOWN |
|---|---|
| Identity score | 50/100 |
| Identity verification confidence | 30% |
- AI page analysis unavailable (page captured; identity not AI-verified)
Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence.
What TrustSniffer observed
First-party facts recorded during the assessment of xaodaodistro.com.
- The request stayed on xaodaodistro.com. It was not redirected to another domain. Clear
- Registration is published under NICENIC INTERNATIONAL GROUP CO., LIMITED. Clear
- DNS for this domain is served by cloudflare.com, across 2 name servers. Noted
- The registration is paid up to 2027-07-03. Noted
- The earliest public archive of this site is from 2026-07-07. Clear
- It is hosted on CLOUDFLARENET, from a server in US. Noted
Domain intelligence
| Registrar | NICENIC INTERNATIONAL GROUP CO., LIMITED |
|---|---|
| Hosting | CLOUDFLARENET - Cloudflare, Inc., US |
| Country | US |
| Server IP | 2606:4700:3034::6815:5344 |
| Name servers | DORTHY.NS.CLOUDFLARE.COM, STANLEY.NS.CLOUDFLARE.COM |
| CDN / edge network | Detected (cloudflare) |
| Resolved IP addresses | 4 |
| Edge IP addresses | 4 |
| Likely origin IP addresses | 0 |
| SSL issuer | WE1 |
| SSL expiry | 2026-11-29 |
| Domain age | 0.32 years (continuous registration) |
| Domain expiry | 2027-07-03 |
| Archive first seen | 2026-07-07 |
| Archive snapshots | 1 |
| Reputation | VirusTotal: 3 flagged | AbuseIPDB: 0% confidence, 0 reports | Google Safe Browsing: 0 matches |
About this assessment
A trust score summarises the evidence TrustSniffer could collect about xaodaodistro.com at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.
TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.