Is xrillaz.com a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

The XRILLAZ website is a single-brand cryptocurrency promotion page. Its landing page is titled "XRILLAZ Allocation Live — Claim Your XRLZ Tokens". It presents a time-sensitive token allocation and invites visitors to claim "XRLZ" tokens. The apparent business model is to move visitors from an announcement-style page into a token-claim flow. In this kind of flow, the visitor's participation, and usually a crypto-asset interaction, is the point of the site.

Scam/Impersonation Risk

The site shows hard contradictions and is assessed as high-risk. Several independent threat-intelligence engines flag the domain, and a tier-one security vendor is among them, so it is blacklisted by outside reporting. Detections span both malicious and suspicious classifications, and a prior phishing-association indicator also attaches to the domain. No conflicting legal entities and no confirmed brand impersonation were observed, so the risk rests on the blacklisting and the lure-style presentation. The "allocation live — claim your tokens" framing is a familiar pattern in token-claim campaigns. Such pages create urgency and push visitors to connect a wallet or authorise a transaction. The behavioural sandbox did not observe wallet-connection prompts, clipboard tampering, hidden forms, or content cloaking in its runs. That is not reassurance, because a claim flow can be gated behind later steps the automated visit did not trigger. The same runs recorded a high share of outbound requests to third-party destinations, and several non-whitelisted external POST submissions were sent from the landing page. Data leaves the page for destinations outside the site's own infrastructure and outside the well-known service providers. This matters for any visitor who enters information. Evidence:

• The homepage title promises a live token allocation and invites visitors to "claim" XRLZ tokens, an urgency-driven call to action.
• Four malicious and four suspicious verdicts were returned across the threat-intelligence engines, including one tier-one vendor, and this triggered the external blacklist condition.
• The homepage sandbox runs recorded 3 non-whitelisted external POST requests and 6 external XHR calls, with a peak external-request share of about 71%, and 3 console errors.
• The domain was registered 2026-07-10 (~0.3 years, about 108 days old) through NICENIC INTERNATIONAL GROUP CO., LIMITED, and expires 2027-07-10.

Regulatory Verification Notes

The site does not establish who operates it. Registrant details are incomplete, which is ownership opacity and not an identity contradiction. The homepage offers no identifiable company name, jurisdiction, or licence or registration reference, and the on-page disclosures could not be confirmed as present. For a business that invites visitors to claim or acquire crypto-assets, the lack of a verifiable operator means no regulator, registry, or accountable party can currently be tied to the offer. No third-party broker or regulatory record matched the domain, so there is no external reputational context to weigh. The independent identity check was inconclusive, so no real-world brand or person can be connected to the site. The site's age profile also needs context. The current registration is recent, while web-archive captures reach back to 2022. The archive record is thin and does not show a substantive, continuous operating history. Evidence:

• The homepage presents no named legal entity, address, or licence or registration number.
• The web archive holds 7 snapshots spanning 2022–2026 (5 years tracked), averaging about 1.4 per year, so there is limited historical continuity to corroborate the site's activity.
• The site's transport encryption is a domain-validated (DV) TLS certificate issued by WE1, valid to 2026-12-06, which confirms encrypted transport only and not operator identity.
• The site is served from AS13335 (Cloudflare, Inc., US).

What to Verify Next

Verification should start with the token itself. The XRLZ token and the "allocation" should be traced to an official project source reached through an independent route, such as a verified listing on a recognised token-data aggregator or an announcement confirmed on the project's established channels. The claim should not be pursued if that source cannot be found. Any claimed operator should be checked against the relevant company or financial-services registry, and the official support or contact channels should be confirmed independently of the page. Organisations that encounter the domain in links, emails, or social posts should check where the link originated, and those links should be treated as potentially malicious until the domain is cleared. Evidence:

• The homepage claim-your-tokens call to action has no verifiable project, issuer, or contract reference attached to it.
• The external intelligence flags remain active against the domain, so any clearance should be independently confirmed.
• The recorded outbound POST traffic on the homepage should be reviewed by a security team before any internal user is permitted to interact with the page.

Summary Verdict

The domain is assessed as high-risk and carries a clearly cautionary posture. Confirmed external threat reporting outweighs everything favourable in the technical profile, such as the valid encryption certificate and stable page behaviour. Only passive, read-only observation is appropriate. Login, credential entry, and any financial or wallet interaction fall into the unsafe category.

Infrastructure Integrity

The domain resolves behind Cloudflare's content-delivery and web-application-firewall network. All observed addresses are edge nodes in the United States, and no origin server was exposed. This provides a protective layer and a valid, mainstream-issued certificate, which count as mitigating factors. It also prevents independent verification of the real hosting location and can mask rapid content changes behind a stable front. The infrastructure therefore cannot offset the external reputation problems, and it says nothing about who operates the site.

Closing Assessment

The site should be avoided for any interactive purpose. That means no wallet connection, no transaction signing, no credential or personal data entry, and no downloads. Anyone who has already interacted with it should review wallet token approvals, revoke any suspicious permissions, and change reused passwords. Security teams should consider blocking the domain at the network level and reporting it to the relevant abuse channels.