Is dex-xrpl.com a scam? TrustSniffer's high-risk assessment: 3/100

Security Alert

Fortinet, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website operates from the domain dex-xrpl.com and presents a homepage titled as the XRP Ledger home page of the official XRPL.org project. Its name and branding suggest a decentralized-exchange portal tied to the XRP Ledger ecosystem. The captured page carried substantial text content and loaded normally, but it exposed no identifiable operator, product catalogue or stated business model beyond that borrowed ledger identity.

Scam/Impersonation Risk

Confirmed contradictory signals are present, and the posture is cautionary. Several security engines currently flag the domain as malicious, and two of the most widely relied-upon engines are among them. This amounts to a confirmed blacklist presence and is the decisive risk factor. The homepage carries the title of the official XRP Ledger site on a separate, newly registered domain, so a visitor could mistake it for the genuine project. The evidence does not show conflicting legal identities, so this is a reputational and brand-proximity concern rather than an identity contradiction. A brand-themed name, a copied page title, very recent registration and active malicious detections together fit the typical profile of an XRP-themed lure site. No wallet-drainer behaviour, clipboard manipulation, hidden forms, cloaking or credential posts to outside parties were observed in the behavioural testing. That does not offset the external detections, because malicious behaviour can be introduced or switched on after a sandbox run. Evidence:

• Homepage: the page title replicates the official XRP Ledger home page title while being served from an unrelated, hyphenated domain.
• Reputation: 12 malicious and 1 suspicious detections were recorded across the security engines consulted, including two top-tier engines.
• Domain provenance: registered 2026-07-30 (~0.24 years old, about 88 days) through the registrar Atak Domain.
• Archive history: 1 archive snapshot, first and last seen 2026-08-03 (1 year tracked), so there is no meaningful operating history.

Regulatory Verification Notes

The captured pages show no financial-services licence, corporate registration number or named legal entity. For a site that appears to offer exchange-style services, this is a significant verification gap. By itself it is not proof of wrongdoing, but here it coincides with the confirmed threat detections. No third-party broker or regulator-style record matches the domain, so there is no independent reputational or regulatory endorsement to weigh against the threat findings. The identity linkage between this site and the real XRP Ledger project is also unconfirmed. The site's own branding therefore cannot be treated as evidence of affiliation. Evidence:

• Homepage and footer: no licence, registration number, regulator reference or legal-entity name was observed.
• Third-party records: no matching broker or regulatory-style profile exists for the domain.
• Transport security: the TLS certificate is a domain-validated certificate issued by WE1, valid to 2026-12-26. It confirms only encrypted transport, not operator identity or legitimacy.

What to Verify Next

Any claim that this site is affiliated with the XRP Ledger or XRPL.org should be checked against the official project's own published channels, reached by typing the known address directly rather than following links to this domain. Any licence or registration claim should be confirmed with the relevant financial regulator's public register before any engagement. The site's contact and support channels should also be validated independently of the site itself. Evidence:

• Homepage: the XRP Ledger branding implies an affiliation that has not been independently established.
• Site-wide: no licence or regulator reference was found on the pages analysed that could be checked against a registry.

Summary Verdict

The domain presents a high-risk trust posture. Confirmed adverse reputation, an extremely young registration history and a page identity borrowed from a well-known project outweigh the few technical hygiene signals present. The evidence is consistent with a site that may be impersonating or exploiting an established brand, and it supports no presumption of legitimacy.

Infrastructure Integrity

The site is served entirely through Cloudflare's CDN and WAF network, with all observed addresses belonging to edge servers and no origin address visible. Cloudflare is a mainstream provider, and this mitigates direct exposure. It also prevents independent verification of the actual hosting and can mask rapid content swaps. Protective infrastructure is treated here only as a mitigating factor and does not establish legitimacy. A heuristic note about a young domain with sparse subdomains is unconfirmed and is given little weight. Evidence:

• Hosting: served from AS13335 (Cloudflare, Inc., US), with four edge addresses observed across IPv4 and IPv6 and no likely origin addresses.
• Registry: ARIN-allocated address space, US geolocation.

Closing Assessment

The site should be treated as unsafe for login, credential entry, wallet connection or any financial transaction. Any viewing should be strictly read-only, and no files should be downloaded from it. Users who reached it through an XRP-related link, message or advertisement should discard that link and navigate only to the official project address they already know.