Is xummrewards.app a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a single-page front end presenting itself under the title "AAA Storage – Safe. Secure. Storage.", a storage-service message that does not match the reward-programme theme of its domain name. The homepage carries only a short block of text, and the site shows no visible products, pricing or operator details. Its apparent purpose and business model cannot be established from the page itself.

Scam/Impersonation Risk: This is a high-risk assessment driven by contradictory external signals. The domain is currently flagged by multiple independent threat-intelligence sources, including at least one top-tier security vendor, and it has been blacklisted as malicious. A separate historical phishing association is also recorded against it. These detections outweigh every mitigating signal. The visible content adds to the concern. The domain name evokes a crypto-wallet rewards programme, while the homepage presents an unrelated storage business under a "safe, secure" slogan. That mismatch is a common pattern in lure sites, and the thin homepage does not explain it. No brand impersonation or conflicting legal identities were confirmed, so the concern rests on the external detections and this incongruity. Behavioural testing found no wallet-connection prompts, no clipboard manipulation, no hidden or credential-harvesting forms and no fingerprinting. Those clean results do not offset the external detections. The homepage still generated heavy third-party traffic: a large share of its requests went to external hosts, including external data submissions and one to a non-whitelisted destination. It also logged a high number of script errors, which suggests an unstable or hastily assembled build. Evidence:

Regulatory Verification Notes: The homepage discloses no company name, licence, registration number, address or legal pages, and the ownership of the domain cannot be tied to any real-world entity, so ownership remains opaque. Because the site shows no financial or regulated service, there is nothing for a regulator to verify. The absence of disclosures is a transparency gap and not evidence of fraud in itself. It matters here only because the external detections already point to risk. No third-party broker or regulatory listing was matched. The domain was registered through NICENIC International Group, a commercial registrar, which gives no indication of who operates the site. Evidence:

What to Verify Next: The site should not be engaged with while the threat detections remain active. Before any future reassessment, check whether the listings have been cleared by the flagging sources, and whether the site later publishes a named operator that can be matched to an independent corporate registry. Anyone who has already visited should confirm that no credentials, wallet details or payments were submitted. Any claim of association with a rewards programme should be checked only through the official channel of the brand the domain name suggests, reached independently of this site. Evidence:

Summary Verdict: The site carries a critical, clearly adverse trust posture. Confirmed external threat detections, a very recently created domain, and an unexplained mismatch between its name and its content all point the same way. The technical hygiene on show does not change that outcome, and nothing supports treating the site as legitimate.

Infrastructure Integrity: The site sits behind Cloudflare's CDN and WAF, and all four observed addresses are Cloudflare edge servers. The origin server is not observable, which prevents independent verification of the real hosting and allows content to be swapped quickly without any visible change in infrastructure. Bot protection is active, and the certificate and edge network are valid. These are mitigating factors only. Protective infrastructure is available to any operator and cannot offset the reputation findings.

Closing Assessment: Avoid logging in, entering credentials or wallet details, making payments or downloading anything from this site. Access, if needed at all, should be limited to passive viewing from an isolated environment.

• Homepage: the title is "AAA Storage – Safe. Secure. Storage.", which does not match the rewards-themed domain name.
• Domain provenance: registered on 2026-08-18 (~0.19 years, about 68 days old), so the domain is very young and has no track record.
• Homepage behaviour: 18 external XHR calls, 12 external POST requests (1 to a non-whitelisted host) and 29 console errors across 3 successful test runs.
• Reputation: 2 malicious and 3 suspicious engine verdicts, with the external blacklist condition confirmed.
• Homepage: no operator name, licence or registration details, and no terms or privacy pages were identified.
• Registration: registrar NICENIC INTERNATIONAL GROUP CO., LIMITED, with registration running to 2027-08-18.
• Hosting: served from AS13335 (Cloudflare, Inc., US).
• Transport encryption: TLS certificate issued by WE1 (DV, domain validation only), valid to 2027-01-15 (80 days remaining). A DV certificate confirms control of the domain, not the identity of the operator.
• Homepage: the reward-themed domain and the storage-themed content need a source that explains their relationship.
• Threat listings: re-check the current external detections after any remediation claim.
• Legal identity: no entity is currently available to look up in a registry.