Is xcorgi.info a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

xcorgi.info is a single-page cryptocurrency token-claim site. Its homepage is titled "xCorgi Allocation Live — Claim Your XCORGI, LUC & LP Tokens". It tells visitors that an allocation of XCORGI, LUC and LP tokens is available and invites them to claim it. The apparent business model is an airdrop or allocation-claim funnel, a format that normally depends on getting visitors to interact with external services and approve transactions.

Scam/Impersonation Risk

This site carries elevated risk, and the contradictory signals are confirmed. The domain is blacklisted. A substantial cluster of independent security engines classify it as malicious or suspicious, and several leading security vendors are among those flagging it. This external consensus is decisive. The site's technical hygiene cannot offset it. No brand impersonation, conflicting legal identities or phishing classification was recorded. The risk rests on the blacklisting and on the site's profile. The page offers "claim" mechanics for newly named tokens, and the domain is only a few months old. This is the pattern commonly used in token-claim lures, where a "live allocation" creates urgency. Behavioural testing found no wallet-connection prompt, clipboard manipulation, hidden forms or cloaking during the captured sessions. That does not clear the site, because malicious behaviour can be gated behind later steps or changed after capture. The same testing showed that a high share of the page's network activity went to third-party destinations. Several of those requests were data submissions (POSTs) to destinations outside the site's own and outside commonly trusted services. A static claim page would not normally need this traffic. The site also produced several browser console errors. Evidence:

• Homepage: the title promises a live token allocation to claim (XCORGI, LUC and LP tokens). The page supplies no independent proof that these tokens or the allocation exist.
• Reputation: 11 security engines rated the domain malicious and 3 suspicious. The combined detections triggered a hard external-blacklist override.
• Behavioural sandbox: 3 non-whitelisted external POST requests, with up to 71.4% of the XHR/fetch activity directed to external destinations. 3 console errors were recorded across 3 successful runs.
• Domain provenance: registered 2026-07-28 (~0.25 years old). The web archive holds a single snapshot, dated 2026-07-31, so there is no meaningful prior history.

Regulatory Verification Notes

The captured homepage contains no licence, registration number or named operating entity that could be matched to a registry. Independent confirmation of who operates the site is therefore not established, and the overall identity picture is unconfirmed. Token-claim offers of this kind are not tied to any recognised regulatory status. No broker-reputation record matched this domain, so there is no third-party regulatory signal to weigh either way. The registration is recent, through NICENIC International Group Co., Limited. The domain's operating history is too short to support any claim of institutional standing. The valid transport encryption confirms only that the connection is encrypted. It says nothing about the operator's legitimacy. Evidence:

• Homepage: no named legal entity, licence reference or registered address is presented alongside the allocation claim.
• Hosting: served from AS13335 (Cloudflare, Inc., US).
• Transport security: the TLS certificate was issued by WE1 at domain-validation (DV) level only, valid to 2026-12-24. DV level confirms control of the domain, not the operator's identity.
• Registration: the registrar is NICENIC International Group Co., Limited, with expiry set for 2027-07-28.

What to Verify Next

Any claim to an XCORGI, LUC or LP allocation should be checked only through channels independent of this site. That means the token project's officially announced channels, reached by a route not linked from this page, and, where relevant, the token contract addresses on a public block explorer. Whether a genuine allocation programme exists should be confirmed there, not on the page itself. Any wallet that has already interacted with the site should be reviewed for token approvals, and any unrecognised approval should be revoked with a reputable approval-management tool. The official support and contact channels of the project should also be confirmed through an offline or independently sourced route. Evidence:

• Homepage: the claim call-to-action cannot be validated from the page's own content.
• Domain age: the domain is a few months old, so no long-standing project presence can be relied on.
• Third-party requests: external data submissions were observed, so any prior interaction should be treated as potentially exposed.

Summary Verdict

The overall posture is high-risk, with a clearly cautionary assessment. Confirmed external threat detections are the decisive factor, and the site's newness and sparse history reinforce rather than soften that conclusion. The available evidence supports no presumption of legitimacy, and the site is unsuitable for any sensitive or financial interaction.

Infrastructure Integrity

The site is fronted by Cloudflare's CDN and WAF. All four observed addresses are edge nodes, and the origin server could not be observed. The certificate is valid and the infrastructure is mainstream, which is a mitigating factor only. Edge-only visibility prevents independent verification of the true hosting and can conceal rapid content changes behind a stable front. Protective infrastructure is commonly used by legitimate and malicious sites alike, so it cannot offset the reputation findings.

Closing Assessment

The site should be treated as read-only at most. No credentials, wallet connections, transaction signatures or payments should be submitted, and nothing should be downloaded from it. Anyone who has already interacted with it should isolate the affected wallet or accounts and seek advice from the relevant security or fraud-response contact.