Is xgalaxymetaverse.com a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

xgalaxymetaverse.com is a recently registered website with a metaverse-style name. During analysis its homepage was served only as a protective interstitial page titled as a suspected phishing notice, so no products, services or business model could be read from the site itself. The name suggests a digital-asset or virtual-world venture, but no on-site content confirms that purpose.

Scam/Impersonation Risk

The site carries a confirmed adverse reputation. Several independent threat-intelligence sources currently flag the domain as malicious, and one major security vendor is among them. A further group of sources rates it suspicious. These detections place the domain on external blacklists. They are the decisive finding and cannot be offset by the site's otherwise orderly technical hygiene. The homepage itself was reachable only as a warning interstitial labelled as suspected phishing, which is consistent with those external detections. No brand impersonation or conflicting legal identities were observed, because no identity content could be retrieved. The contradiction comes from the blacklist and detection evidence alone. In sandbox testing the site did not attempt wallet connections, clipboard manipulation or hidden credential forms. This does not clear it, because the visible page was a gateway rather than the site's real content. A heavy volume of third-party requests, including several outbound data submissions, and a high count of browser console errors indicate an unstable, externally dependent front end. The detections point to a credible risk of phishing or malicious-content delivery, so the domain should be treated as hostile until the listings are formally delisted. Evidence:

• Homepage: served as a security interstitial with a title denoting suspected phishing rather than any site content.
• Reputation checks: multiple engines classify the domain as malicious and several more as suspicious, including a tier-one security vendor.
• Behavioural testing: 35 external XHR/fetch requests and 9 external POSTs, none to non-whitelisted destinations, plus 28 console errors; no wallet-drainer or clipboard-hijack behaviour.
• Web archive: only 2 snapshots, spanning 2021–2026, which is too thin to establish a continuous operating history.

Regulatory Verification Notes

No licence, registration number, legal entity name or regulator affiliation could be assessed, because the legal and identity pages were not retrievable behind the interstitial. The site's disclosure state therefore remains unclear. The registrant details are also incomplete, so the real-world operator cannot be independently tied to the site. This is ownership opacity, an administrative limitation that adds uncertainty. It is not an identity contradiction. No third-party broker or regulatory-database record exists for the domain, so no external regulatory standing can be cited in either direction. The current registration is very recent and is held through a budget-tier registrar, NICENIC. That contrasts with the earlier archive capture from several years ago. This suggests re-registration or a change of control, though the evidence does not establish which. Evidence:

• Domain registration: created 2026-07-03 (~0.32 years old, ~115 days), expiring 2027-07-03, registered via NICENIC INTERNATIONAL GROUP CO., LIMITED.
• Transport encryption: TLS certificate issued by WE1 (DV, domain-validated only), valid to 2026-11-29 with 33 days remaining. DV confirms domain control, not organisational identity.
• Hosting: served from AS13335 (Cloudflare, Inc., US).

What to Verify Next

The decisive question is whether the external detections have been cleared. Re-check the domain's status with the reporting security vendors before any engagement, and treat any delisting as provisional until the content can be seen. Anyone who has a business reason to deal with the operator should establish the legal entity and any claimed licence through the relevant public registry, not through anything the site says about itself. They should confirm official contact channels through an independent, offline route. The ownership change implied by the gap between the archive history and the recent registration should be explained by the operator in writing. No wallet should be connected and no credentials entered while these checks are open. Evidence:

• Homepage and legal pages: not viewable in their real form, so no on-site claims can be relied on.
• Domain history: the 2021 archive capture and the 2026 registration are not reconciled by any public record in the evidence.
• Sandbox runs: all 3 behavioural runs completed without triggering wallet or form-submission activity, so none of the site's transactional flows has been observed.

Summary Verdict

The overall posture is high-risk. Confirmed external threat detections drive the assessment, and the site's real content and operator remain unverified. Its unsafe uses are login, credential entry and any financial interaction. Read-only observation is the only use consistent with the evidence.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and WAF, and all four resolved addresses are edge servers, so the origin host cannot be seen or independently verified. The bot-challenge layer is what produced the warning interstitial. Edge-only visibility can mask rapid content changes behind the same front door. The infrastructure is professionally operated and counts only as a mitigating factor. It does not offset the reputation findings.

Closing Assessment

The site should not be used for sign-in, payments, wallet connections or any download. Any contact with it should be limited to read-only viewing in an isolated environment. Anyone who has already interacted with it should change reused credentials and review any wallet approvals.