XM Global: Scam or Legit? Borrowed XM Logo, 10-Day-Old Domain, No License

A site at xmhyfjs.web.id greets visitors with the red and white XM logo and the promise of AI-driven binary options trading, so we tested it against the real XM.

The real broker is a Cyprus-licensed firm on other domains, while XM Global shows no company, no license and no address, and its code still names another brand.

Overview

What the Site Offers

We found a trading app that sells AI-driven binary options, copy trading and a service where an AI model trades your money for a set number of days.

The page title is just XM and the logo is the broker’s.

The home page shows a $124,420.50 balance, a $2,340 daily gain and a monthly return of 28.5%.

The sign-up form marks an invitation code as required, and you can pay in by crypto transfer or bank wire. Withdrawals go through a request that can be rejected.

What the Checks Found

The real XM answers to the Cyprus Securities and Exchange Commission under license 120/10, and the regulator’s approved domains for that firm do not include this site.

The domain was registered on November 1, 2026, ten days before our checks, yet its About page dates the company to 2020 and lists half a million users.

The dashboard figures are typed into the page code, and every AI signal carries the same 85% confidence.

The careers code asks for résumés at an email address on an unrelated parked domain.

What We Could and Could Not Verify

Here is where the evidence stands after our checks:

• Verified by us: the XM branding, the domain and certificate dates, the hosting block, the founding and user figures, the wallet code and the real XM’s license entry.
• Not found: a company name, a license number, a physical address, terms we could read, or any link between this site and the real XM.
• Not verified: where deposits go, whether anyone has withdrawn money, and whether any AI model trades. We did not register, log in or pay.

Our advice is not to deposit anything and not to connect a wallet, and the sections on leaving and reporting below cover anyone who already did.

The Real XM Is Not the Operator

We started with the brand, because the site borrows its logo and its name, and we wanted to know who the real XM is before judging the copy.

The footer of xm.com names the operator as Trading Point of Financial Instruments Limited, registration number HE251334, at 12 Richard and Verengaria Street, Limassol, Cyprus.

The same footer adds that XM is a trading name of Trading Point Holdings Ltd, and the Regulation page names the Cyprus regulator and license number 120/10.

We then opened the regulator’s entry for that firm, which confirms license 120/10, dated August 5, 2010, company registration number 251334 and the same Limassol address.

The entry lists three approved domains for the firm: trading-point.com, xm.com and pipaffiliates.com. We also searched the regulator’s full list of approved domains for xmhyfjs.web.id and found nothing.

RDAP, the public registration database, lists xm.com as registered in 1994 and xmglobal.com in 2003, both at GoDaddy and both on the same Akamai name servers.

That matters for anyone who searches the name XM Global. Those older domains are a different setup from the site we examined, registered only ten days earlier.

The real broker’s pages cover CFD trading and carry a warning that 76.15% of retail investor accounts lose money with the provider.

The pages we read never mention binary options.

So the licensed firm is the victim of a borrowed identity here, not the operator, and nothing we found suggests that it runs or profits from xmhyfjs.web.id.

We also looked for a public warning about this site on the xm.com pages we opened and found none, which is not surprising for a domain this young.

What We Saw at the Front Door

We captured the home page and read its code as plain text, without running anything, to see what a visitor meets before signing up.

A new-generation intelligent trading platform greets you, with a headline reading intelligent trading within reach and a sentence offering AI-driven binary options, copy trades and 24-hour service.

The English reads oddly. It promises support for documentary transactions, which is what a literal translation of the Chinese phrase for copy trading would produce.

That is no accident of style: the pages we read ship their text in Chinese and pass it through a translation function, so the English is a layer on top.

A row under the headline lists the Bloomberg, Reuters, Forbes, TechCrunch and CoinDesk names beneath a line about recognition by leading global media.

In the code those five names are plain text, with no link, no article and no logo file behind them, so the line proves nothing about coverage.

Another row lists five AI models, including GPT-4o, Claude 3.5, DeepSeek, Gemini Pro and Qwen-Max, under the heading Top 5 global AI models.

Nothing on the page explains how any of them connects to a trade.

We found only four signal tiles, for USD/CNH, BTC/USDT, a stock called SOHU and crude oil.

We opened the sign-up page the way a visitor would, without typing anything into the form, and its fields included a required invitation code.

Testing the Earnings Pitch

The most concrete promise on the home page is the dashboard, so we put numbers to it.

It shows total assets of $124,420.50 and earnings of $2,340 for today, a gain of 1.88%, beside a tile labeled plus 28.5% for the month.

Those two figures cannot belong to the same account. A month at 28.5% works out to 0.84% a day, less than half the 1.9% shown for a single day.

Repeating the daily gain is stranger still. At 1.9% a day for 30 days a balance grows 1.76 times, and over a year it grows 963 times.

That would turn $124,420.50 into about $120 million. Even the more modest monthly figure compounds to 20.3 times in 12 months, or about $2.5 million.

No real trading account does this, and we can be firm because the page code itself holds the numbers.

The balance, the daily gain and the 28.5% sit in the home page script as fixed values.

The four AI signal tiles follow the same pattern. Each shows an AI confidence of 85%, and the number 85 appears four times in the code, once per tile.

A confidence score that never moves for a yuan pair, bitcoin, a Chinese internet stock and crude oil is a decoration, not a measurement.

Binary options make the arithmetic harder for a buyer.

If a win paid $0.85 of profit on each $1 staked, an illustrative rate and not one we saw, you would need to win 54.1% of trades to break even.

The AI custody page shows the real picture in miniature.

Its headline promises to grow your assets automatically around the clock, while its small print warns that AI trading does not guarantee profit.

Founded in 2020 on a Ten-Day-Old Domain

The About page makes the strongest identity statements on the site, so we compared them with what we could measure.

It reads Founded in 2020, with more than 200 employees in over 50 countries, 15+ industry awards, 500K+ registered users, $2B+ in cumulative volume and 99.9% availability.

The domain tells a different story. RDAP shows xmhyfjs.web.id was registered on November 1, 2026 at 07:42 UTC, through the Indonesian registrar PT Jagoan Hosting Indonesia.

The site’s security certificate was issued by Let’s Encrypt the same day at 12:39 UTC, four hours and 57 minutes after registration.

It covers only this domain and its www version.

The Internet Archive holds no snapshot of the domain, so no older version of the site can be found.

A company can launch a new domain, but the numbers must then have been earned somewhere else.

If every user joined after registration, 500,000 users in ten days means 48,600 sign-ups a day.

The sign-up page gives a different head count. It invites you to join 150,000+ traders, less than a third of the About page figure.

The story text on the About page adds a third version, stating that the platform has served millions of users.

At $2B in volume over ten days the platform would have handled roughly $194 million a day, with no license shown anywhere on the site.

The About page also lists four leaders: a CEO and co-founder, a CTO, a CFO described as a former top investment bank executive, and a COO.

In the code each card holds only initials, a name, a title and a one-line biography, with no photo, link or company number that a reader could check.

None of the headline numbers can be tied to a company, an audit or a registry entry, which makes them marketing copy and not evidence.

Code From Another Brand

The most telling findings came from the page code, which we downloaded as text and read without executing anything.

The brand name is not written into most sentences at all. The footer reads Copyright 2026 followed by a variable in double square brackets.

The same variable stands in the testimonials and the referral rules.

At run time the app swaps in a name, here XM, so the testimonials were written once for any brand.

One leftover shows what the template was called before. The code stores your light or dark theme under a setting named nexustrade-theme.

The careers code asks applicants to write to careers@nexustrade.com. We probed nexustrade.com and it returns a bare page on parking-style name servers, registered in 2004.

That does not look like the home of an AI trading company, and it fits a template that was never edited for this brand.

The careers code lists five jobs in Singapore, Hong Kong, London and remote work, and a welcome line that reads Welcome to NexusTrade.

When we loaded that page in English it rendered with almost no text, so a visitor would not see most of this.

The wallet login also deserves a note. The sign-up and sign-in code offers a wallet connection through MetaMask, Trust Wallet, TokenPocket or TronLink, and it requests only your account address.

That address goes to the site with the invitation code. We saw no request for a signature in that code, so the site never proves who owns the wallet.

The top-up code includes a branch for the TRON Nile test network, which suggests that development settings were left in a site that now asks for real deposits.

The page head carries no analytics or advertising identifiers and loads only the site’s own files and Google Fonts, so the usual tracking trail linking sister sites was not available.

How the XM Global Pitch Works

Step 1: A borrowed name and a polished page

The page opens with a regulated broker’s logo and a dark, professional design, so a visitor who knows XM from advertising may assume it is the real thing.

The page title is just XM, and the address xmhyfjs.web.id contains the letters but not the name of the broker.

Step 2: An invitation code and a $100 bonus

The sign-up page promises free registration with no hidden fees, an exclusive $100 transaction bonus for new users and up to 8% rebate for inviting friends.

The invitation code field carries a required marker, which ties each account to its referrer, and the referral page shows that person earning when you trade.

Step 3: A deposit

The deposit page offers three routes: crypto transfers in USDT, BTC or ETH, an online USDT top-up credited in 1 to 5 minutes, and bank wires with SWIFT details.

After a crypto transfer you submit a ticket with the transaction hash and a proof screenshot, and the status stays pending review until staff confirm it.

The wallet addresses and bank details load after login, so we never saw where the money goes, and a crypto transfer cannot be reversed once sent.

Step 4: Trading, custody and a referral tree

Inside the app a visitor can place binary options, copy other traders, or hand money to an AI model for a number of days.

The custody form lets you pick a model, a strategy, an asset group and trading hours, and it shows an expected return next to a historical win rate range.

The referral page lays out three levels.

You earn a share of the trades of the friend you invite, of the friend that person invites, and of the friend after that.

The percentages load from the server, and a limited-time event can add extra points to every level, so the page rewards recruiting as much as trading.

Step 5: A withdrawal that needs approval

The withdrawal page promises crypto payouts in 10 to 30 minutes or a bank wire, with a fee line and warnings for a minimum, a maximum and a daily limit.

Each request can end as pending, processing, completed, failed, rejected or cancelled, and the page warns that a wrong address or network means the assets are lost.

A testimonial on the home page promises withdrawals within 10 minutes, while the withdrawal page allows 10 to 30 minutes, so even the speed promise differs between screens.

Who Is Behind XM Global?

The company named in the documents

We found no company anywhere on the site.

The footer holds a copyright line with a blank where a name should be, and nothing in the code names a legal entity.

The sign-up form names a Terms of Service and a Privacy Policy, but we did not open them, so we cannot say which company they name or what they promise.

The only company details in the code belong to the template, in the nexustrade.com address. The real firm’s registration number 251334 and Limassol address came from its own pages.

Where the address and registration lead

No postal address, phone number or registration number appears in the pages we captured, so there is nothing to look up in a business or financial register.

The only registration we could check is the one that matters most: the real XM’s entry at the Cyprus regulator, which lists none of this site’s details.

The domain has a registrar in Indonesia, name servers a12.share-dns.com and b12.share-dns.net, and a server address in a block that the American registry assigns to Kurun Cloud Inc.

A hosting company’s address shows where a server runs, not who runs the business, and we draw no conclusion about the owner from it.

Domain, platform and reviews

The domain was registered ten days before our checks, and the certificate followed within five hours, which fits a site launched quickly and not one that has operated for years.

The platform is a single-page app built in a Chinese-language framework, with menus for binary options, contract trading, copy trading and AI trading.

The menu code also lists a credit services entry that we could not open.

A shared component beside the copy-trade button carries a Chinese label that translates as bet ratio, which is vocabulary from gambling and not from regulated investing.

We found no independent review, registry entry or press coverage tied to this domain, and the media names on the home page are plain text.

What we could not confirm

We did not register, log in or pay, so we could not see the deposit addresses, the payout percentages, the terms or what happens when a user asks to withdraw.

We also could not read the real XM’s other site, xmglobal.com, because our server request received an access denied reply, and we did not work around it.

We cannot say who operates xmhyfjs.web.id, whether it handles real trades, or whether it pays anyone, and we did not trace the code beyond the pages we read.

What to Do If You Signed Up or Deposited

1. Do not deposit. A site that shows no company and no license has given you nobody to hold responsible, so keep your money in a regulated account.

2. Check the domain. The real broker’s pages and its regulator entry list xm.com and trading-point.com, so treat any other address that uses the name as unrelated.

3. Never connect a wallet. If you connected one, remove the site’s permissions in your wallet settings and move your funds to a new wallet.

4. Stop paying and stop recruiting. Do not send a top-up to unlock a withdrawal and do not invite friends, because the referral levels pay from their activity.

5. Save the evidence. Keep screenshots of the app, your account ID, the transaction hashes, the wallet addresses you paid and any messages from the people who invited you.

6. Ask your bank about a wire. Contact the bank that sent a wire at once, give the transfer details and ask whether a recall is possible, since speed matters.

7. Dispute card payments. If a card was involved, send your issuer a dispute letter as soon as you can and keep a copy.

8. Report it. File a report at ReportFraud.ftc.gov with the domain, wallet addresses and amounts, and treat any offer to recover money for a fee as another scam.

Frequently Asked Questions

Is XM Global a scam?

We cannot prove what its operators intend, but it uses a licensed broker’s logo, names no company and tells a founding story its domain cannot support.

We would not trust it with money.

Is xmhyfjs.web.id the real XM?

No. The real XM operates through xm.com under Cyprus license 120/10, and the regulator’s approved list for that firm does not include xmhyfjs.web.id.

Is the real XM at fault?

We found nothing connecting it to the site. The licensed broker looks like the party whose name and logo were borrowed, not the operator or a beneficiary.

Can I earn 28.5% a month with its AI trading?

The figure is a fixed value in the page code, so it matches no account.

Sustained growth at that rate would turn $124,420.50 into about $2.5 million in a year.

Why does the site need an invitation code?

The code ties each new account to a referrer, and the referral page pays three levels of inviters from the trades of the people below them.

What if I already sent crypto?

A blockchain transfer cannot be reversed by the sender, so record every address and hash, report them, and ignore anyone who promises to recover the money for an advance fee.

The Bottom Line

Do not deposit at XM Global or connect a wallet to it. It borrows the XM logo while showing no company, no license and no address.

If you want to trade, use a broker you can find on its regulator’s own register, and open its website by typing the address yourself, not through an invitation link.

If you already deposited, stop paying, save every transaction detail, contact your bank or card issuer at once, and report the domain and wallet addresses.