Is xpunkvault.com a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

The website is a single-page promotional site for "XPUNK," presenting itself with the headline "NFT Allocation Is Live". It appears to be a token or NFT allocation campaign aimed at prospective buyers or participants, and the likely business model is collecting sign-ups, wallet interactions or payments tied to an NFT distribution. The site is very new, and no named operator or detailed product documentation could be tied to it.

Scam/Impersonation Risk

This site carries a confirmed adverse reputation. It is blacklisted by multiple independent threat-intelligence sources, and several major security vendors currently classify it as malicious or suspicious. The convergence of these listings is the decisive factor in this assessment. No named brand impersonation or conflicting legal identities were observed, so the risk rests on the external listings and on how the site behaves. Behavioral testing of the homepage found that outbound requests accounted for a high share of its network activity. Several background and form-style submissions went to external destinations outside any recognized, trusted set. The tests did not observe wallet-connection prompts, clipboard tampering, hidden forms or content cloaking. The data therefore does not show how the site extracts value, but the pairing of an urgent "allocation is live" call to action with unexplained outbound data transfers is the pattern commonly used in NFT-minting and token-claim lures. No evidence was supplied of any page-level fraud content beyond that headline. Evidence:

• Homepage: titled "XPUNK — NFT Allocation Is Live," with an urgency-driven allocation pitch and no further product or company detail captured.
• Reputation: 6 security engines flagged the domain as malicious and 4 as suspicious, including Fortinet, Kaspersky and Sophos.
• Homepage behavior: 3 external POST requests to non-whitelisted destinations across 6 external XHR calls (up to 71.4% external traffic), plus 3 console errors.
• Domain history: registered 2026-08-27 (~0.16 years old), with only 3 archive snapshots spanning 2026-09-04 to 2026-09-22 (1 year tracked).

Regulatory Verification Notes

No licensing, registration or regulatory standing was found. No third-party broker or regulatory record matched the domain. The page content that was captured contains no verifiable company name, jurisdiction or terms, so the legal and identity pages that would normally support an NFT or token offering could not be assessed. Ownership is opaque, and the real-world operator has not been independently connected to the site. The registration record names the registrar but gives no usable owner details. A valid but entry-level certificate and established-vendor hosting show only that the site is technically operational. They say nothing about who runs it or whether it is authorized to sell digital assets. Evidence:

• Registration: the domain was registered through NICENIC International Group Co., Limited, expiring 2027-08-27, with incomplete owner details.
• Transport security: TLS certificate issued by WE1 (DV, domain validation only), valid to 2026-11-26 (31 days remaining at analysis).
• Hosting: served from AS13335 (Cloudflare, Inc., US).
• Homepage: no license number, legal entity name or regulatory reference was captured.

What to Verify Next

Because of the adverse reputation, verification should precede any engagement and should not rely on anything the site says about itself. The campaign's existence and its official channels should be confirmed through the project's own announcements, reached by an independent route rather than a link from this site. Any claim of an NFT allocation should be matched against a recognized marketplace listing or a published smart-contract address that can be checked on a public blockchain explorer. If the operator claims regulated status, the licence should be checked directly in the relevant regulator's public register. Anyone who has already interacted with the site, especially by connecting a wallet or submitting details, should review wallet approvals and revoke any unfamiliar permissions. Evidence:

• Homepage: the allocation is described as "live," but no contract address, marketplace or team identity was captured.
• Third-party detections: the listings remain active, so the site's own assurances cannot be taken at face value.
• Domain age: registered about two months before analysis, so no long-standing track record exists to rely on.

Summary Verdict

The available evidence places this website in a clearly high-risk posture. Active adverse listings from several independent sources, together with a very young domain and unexplained outbound data flows, outweigh the technical hygiene signals. These signals show a functioning site but no trustworthy operator. The operator's identity is unverified, and the legitimacy of the offering is unsupported.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and WAF, and all four observed addresses are edge servers, so the origin server could not be seen. A valid TLS certificate and a clean abuse history for the edge network are modest mitigating factors. Edge-only visibility also prevents independent verification of the real hosting and makes it easier to swap content quickly. Protective infrastructure does not offset the external threat listings.

Closing Assessment

The site should not be used for logging in, connecting a wallet, supplying credentials or making any payment or financial commitment. Viewing the page is the only low-risk interaction, and it is best done from a non-sensitive device or browser profile. Anything downloaded from or signed on this site should be treated as untrusted.