Is xquake.info a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

The website xquake.info is a recently registered domain whose homepage could not be retrieved in ordinary form. Automated capture was met by a security interstitial headed as a suspected-phishing warning, and only a short fragment of page text was returned. The site therefore presents no observable product, service or business model, and its apparent purpose cannot be established from its own content.

Scam/Impersonation Risk

Material contradictions are present, and this is the decisive element of the assessment. The domain is currently blacklisted by external reputation sources, with several independent security engines classifying it as malicious or suspicious. At least one tier-one security vendor is among them. A protective interstitial also labelled the destination as suspected phishing when the homepage was requested, and the domain carries a known-phishing association. These signals converge on a clear impersonation and phishing concern. No conflicting legal entities were observed, because no legal or identity pages could be captured. The concern rests on the threat-intelligence convergence, not on any brand claim the site makes. Behavioural testing found no wallet-connection prompts, clipboard manipulation, hidden forms or external password submission, and it recorded a very high share of outbound third-party traffic and heavy page-script churn. These observations do not offset the reputation findings. The domain's youth and the near-absence of any independent history remove the benefit of the doubt that an established site would receive. Evidence:

• Homepage request: the destination returned a blocked response with a security challenge page titled as a suspected phishing site.
• Reputation checks: 7 engines flagged the domain as malicious and 2 as suspicious, including one tier-one vendor, and the domain is on an external blacklist.
• Domain provenance: registered 2026-07-25 (~0.26 years old), with a single web-archive snapshot captured in 2026 and no earlier history.
• Behavioural testing (three runs): 99 external XHR/fetch requests, 9 external POSTs, 29 console errors, and a DOM mutation spike of 1,523 changes after interaction.

Regulatory Verification Notes

No legal, licensing or registration disclosure could be assessed, because no policy, terms, about or contact pages were obtained. Nothing on the site supports a regulated or licensed status, and no third-party regulator or broker database lists the domain. The absence of a licensing record is not treated as evidence of wrongdoing. It carries weight here only because it coincides with the confirmed threat findings, so no regulatory standing can be inferred for the operator. The real-world operator is not independently connected to any identifiable brand or person, and the available evidence supports no claim of legitimacy. Transport encryption is present, but a basic domain-validated certificate does not attest to operator identity. Evidence:

• Domain registered through NICENIC International Group Co., Limited, created 2026-07-25 and expiring 2027-07-25.
• TLS certificate issued by WE1 (DV, domain-validated only), valid to 2026-12-21 with about 52 days remaining.
• Served from AS13335 (Cloudflare, Inc., US).
• No third-party broker or regulator record matched the domain.

What to Verify Next

Before any engagement, the party considering contact should establish through independent, offline channels whether the claimed operator exists. Any invitation, link or message that led to this domain should be traced back to its sender through a route that does not use the site. If the site is said to belong to a known brand, that brand's official domain should be obtained from a trusted source and compared. Any licensing or registration claim should be checked directly with the relevant registry. The site's official contact channels should be confirmed independently. Security teams should re-test the domain only from an isolated environment, and only after the threat listings have been reviewed or cleared. Evidence:

• The blocked homepage capture means no on-site claims could be checked against external records.
• The domain's first appearance in public records dates from 2026, so any claim of a long operating history is unsupported.
• Active threat listings from multiple sources remain unresolved.

Summary Verdict

The assessment is a critical-risk posture. Confirmed blacklisting, a suspected-phishing classification, a very young domain with essentially no history, and no verifiable operator identity point the same way. Technical hygiene and a valid certificate cannot outweigh this, and the domain is treated as hostile until evidence shows otherwise.

Infrastructure Integrity

The domain sits behind Cloudflare's CDN and WAF. All observed addresses are edge servers in the United States, and the origin server was not observable. The certificate is valid and the hosting provider is a mainstream, well-established one. This is a mitigating factor only. Edge-only visibility prevents independent confirmation of where the content is actually hosted, and the infrastructure offers no assurance about the operator's intent. It does not offset the reputation findings.

Closing Assessment

No login, credential entry, wallet connection, payment or file download should be attempted on this domain, and any link or request that led to it should be treated as hostile and reported to the appropriate security contact. If the domain must be examined, it should be viewed read-only from an isolated environment.