Is xsjiamei.com a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a single-page storefront whose page title reads "Buy Gold Tokens | De.Fi". It presents a short, text-based offer to purchase gold-linked digital tokens and appears to operate as a token-sales or crypto-asset promotion front. The title uses the name of a recognizable decentralized-finance brand, but nothing collected independently connects the site to that brand or to any identified operator.

Scam/Impersonation Risk

Contradictory signals are present and are decisive. Two major security vendors currently flag the domain as malicious, and a number of other engines return malicious or suspicious detections. The domain is blacklisted by external threat-intelligence sources, and its reputation record also carries a prior phishing association. No conflicting legal entities were found, and the collected page content shows no confirmed on-page impersonation. The reputational detections nonetheless stand on their own as a serious warning. The domain is also only a few months old. This matters because the offer is a token purchase, where a payment is hard to reverse. The title's borrowed DeFi branding sits uneasily beside a fresh domain with no history and a hostile reputation record. In browser sessions the site served pages reliably and showed no wallet-draining, clipboard-hijacking, hidden-form or cloaking behavior. It did, however, make background requests to three external hosts outside the expected set of well-known services, and external sources accounted for a very large share of its traffic in at least one session. This is a modest behavioral concern and does not offset the reputation findings. Evidence:

• Domain registered 2026-07-30 (~0.23 years old, roughly 83 days), expiring 2027-07-30, so the domain is very young.
• Homepage: title "Buy Gold Tokens | De.Fi" with about 4,200 characters of text and no identifiable operator.
• Homepage behavior sandbox, three runs: three non-whitelisted external XHR calls, external traffic up to 84.1% in one session, no wallet-connect, drainer, clipboard or cloaking activity.
• Reputation checks: six malicious and one suspicious detection from security engines, including two top-tier vendors.

Regulatory Verification Notes

The collected content gives no confirmable evidence of licensing, registration or a named legal entity behind the token offer. The page's disclosure position could not be established. A real-world operator identity has not been independently verified, so no legitimacy should be inferred from the site's presentation. A third-party broker-reputation lookup returned no match. This is a neutral contextual signal and not a regulatory finding. Financial-style offerings of this kind would normally be expected to identify a regulated issuer or seller. The security reputation findings above, not this transparency point, drive the cautionary posture. Evidence:

• Registrar: Dynadot, with registrant details held behind its privacy service.
• Hosted on AS51852 (Private Layer INC), registry LACNIC, country Panama.
• TLS certificate issued by YR1 (Domain Validated), valid to 2027-01-05. This confirms only encryption and domain control, not operator identity.
• Homepage: no regulator, license number or corporate registration identified in the collected content.

What to Verify Next

Any dealings should stay at read-only viewing until the operator is identified. If the offer is of real interest, the claimed seller should be identified and confirmed through a regulator's public register, not through details on the site. The site should not be treated as the official channel of any brand named in its title unless that brand confirms it through its own independently known contact route. Payment cards, wallets and credentials should not be used on the site until a reputable third party has reviewed the domain and the listings have been cleared. Anyone responsible for the site who believes the listings are mistaken should seek delisting through the relevant vendors. Evidence:

• Homepage title referencing a DeFi brand: confirm with that brand directly through channels known independently of this site.
• Homepage token-purchase offer: no named seller or registry entry available to check.
• Current malicious detections: re-check reputation status before any reconsideration.

Summary Verdict

The site carries a critical risk posture. Confirmed external threat detections outweigh every technical positive and decide the assessment. The evidence points to a very new, anonymous, unverified operation. It is not suitable for login, credential entry or financial transactions.

Infrastructure Integrity

The site runs on a commodity data-center hosting provider with no content-delivery network or web application firewall in front of it. Several addresses appear to point directly at origin servers, so there is no protective layer to mitigate exposure. Unconfirmed heuristics note a mismatch between the hosting registry region and the country, a fragmented address footprint, and the thin subdomain structure typical of a new domain. These are weak indicators. The valid encryption certificate and a stable hosting response are the only mitigating points, and they do not offset the reputation findings.

Closing Assessment

Users should limit themselves to viewing the page and should not enter credentials, connect wallets or make payments. Anyone who has already interacted with the site should review account and wallet activity and rotate any shared credentials.