Is xyz-welcome-bonus.com a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website, xyz-welcome-bonus.com, presents a cryptocurrency trading interface. The captured page is a trade view titled "BTC | Hyperliquid". It sits behind a browser-verification challenge and runs under a domain name built around a promotional "welcome bonus". The apparent purpose is to draw visitors into a derivatives or spot trading flow. The site lends itself to a bonus-led onboarding funnel, and its operator is unidentified.

Scam/Impersonation Risk

This is a materially elevated-risk site. An external threat-intelligence source currently blacklists the domain, and a major security vendor flags it. The page title borrows the name of a well-known perpetuals trading venue, yet the domain has no evident connection to that brand. Pairing a third-party venue name with bonus-themed domain wording is a recognised lure pattern for fake trading and promotion funnels. The evidence does not establish a phishing verdict, a confirmed brand takeover or conflicting legal identities. The blacklist hit is the decisive contradiction. The domain is also only weeks old, so it has no track record to offset that hit. In the behavioural sandbox, the page made a heavy volume of calls to outside services during interaction, including form-style submissions to several destinations outside the expected set of trusted providers. It also produced a very large number of console errors. No wallet-connection prompts, clipboard tampering, hidden forms, cloaking or fingerprinting were observed. This means no specific credential-theft mechanism was demonstrated in the captured session. The outbound data flow and the blacklist status still make any account or payment interaction unsafe. Evidence:

• Homepage and trade view: the page title reproduces a third-party trading venue's name under an unrelated bonus-themed domain.
• Threat-intelligence status: the domain is blacklisted by an external source and flagged by one major security vendor, with several further suspicious verdicts.
• Behavioural sandbox on the trade view: 63 external XHR/fetch calls, 14 external POSTs (5 to non-whitelisted destinations) and 118 console errors across three runs.
• Domain registered 2026-08-31 (~0.15 years, ~54 days old), expiring 2027-08-31, through NICENIC INTERNATIONAL GROUP CO., LIMITED.

Regulatory Verification Notes

The captured page gives no clear licensing, corporate registration or operator disclosure. Because the page sits behind an access challenge and its text is brief, the on-site disclosure position is unclear rather than affirmatively deficient. The operator's real-world identity is not independently verified, and registration details are incomplete. This is ownership opacity, an administrative limitation, and not an identity contradiction. No third-party broker or regulator listing was matched to the domain. The site therefore cannot lean on any recognised regulatory standing. Derivatives and bonus-linked trading products would normally be expected to carry such disclosures. A valid but entry-level certificate shows only that the connection is encrypted. It says nothing about who runs the site. Evidence:

• Trade view: no visible licence, registered entity name or regulator reference in the captured content.
• Hosting: served from AS13335 (Cloudflare, Inc., US).
• Transport encryption: TLS certificate issued by WE1 (DV), valid to 2026-11-29, with about 35 days remaining.
• Broker reputation dataset: no match for the domain or its name.

What to Verify Next

No verification step can make the current blacklist status acceptable, so these steps are for anyone who must still assess the site. First, check whether the trading venue named on the page operates under this domain. Do this by typing that venue's official address from an independent source, never through this site or a link to it. Next, confirm whether any operator named here holds a licence with the relevant financial regulator's own register. Then check official support channels through an independent route and ignore any contact details given on the site. Last, re-check the domain's threat-intelligence status before any further interaction. Lists are updated and the status could change. Evidence:

• Homepage and trade view: no operator name or registry reference is available to check.
• The page's use of a third-party trading venue's name is the specific claim to test against that venue's official channels.
• The domain's blacklist status is the item to re-check against current reputation sources.

Summary Verdict

The overall posture is high risk. An active external blacklist listing, a brand-borrowing presentation and a brand-new domain converge on a site that should be treated as potentially deceptive. The few technical positives are routine and do not offset these concerns.

Infrastructure Integrity

The site is delivered through Cloudflare's CDN and WAF. All observed addresses are edge nodes and the origin server was not observable, which prevents independent confirmation of where the content is actually hosted. The valid certificate and recognised provider are mitigating factors only. They do not offset the reputation findings, and a young domain with sparse subdomains is consistent with fast-moving infrastructure.

Closing Assessment

Do not log in, connect a wallet, deposit funds or enter personal or payment details on this site, and do not follow bonus or promotional offers that lead to it. Anyone who has already interacted with it should treat any shared credentials as exposed and rotate them. They should also check their accounts and wallet permissions for unauthorised activity.