Is events-xrpl.live a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a single-page presence on a newly registered ".live" domain. The domain name refers to events on the XRP Ledger. The homepage is titled "Cold Storage in Your Pocket" and carries the name of the Xaman wallet product, so it presents itself as a self-custody crypto wallet offering. Its apparent purpose is to draw visitors into wallet-related interactions on a short, thin page.

Scam/Impersonation Risk

Contradictory signals are present, and they are decisive. The domain is blacklisted by multiple independent security sources, and several major security vendors independently flag it as malicious. That convergence outweighs everything else in the technical profile. The wallet-themed branding and the XRP Ledger reference in the domain name make this a recognisable lure pattern for credential and recovery-phrase theft. The evidence does not establish whether the site is actually affiliated with the wallet brand it names, and no conflicting legal identities were found. Automated browsing showed no wallet-connection prompts, clipboard tampering, hidden forms or cloaking. It did record outbound data submissions from the page to several third-party destinations that are not on any known-service list. Those submissions are unexplained for a page this small. Page-content analysis returned no contact-channel anomalies. Ownership is opaque, which is an administrative limitation and not an identity contradiction. Evidence:

• Homepage: the page title presents a "Cold Storage in Your Pocket" wallet pitch under the Xaman name, on a domain that is not otherwise tied to that brand by any evidence.
• Domain provenance: registered 2026-07-17 (~0.28 years old), so the site has no track record behind the wallet claims it makes.
• Homepage behaviour: three automated sessions recorded outbound POST requests to non-whitelisted third-party hosts, and 3 console errors.
• Reputation: several major security vendors flag the domain as malicious, and it also appears on an external blacklist.

Regulatory Verification Notes

The captured homepage identifies no operating company, jurisdiction, licence or registration number, and the page text is very short. For a site pitching custody of digital assets, that is a verification gap. On its own it is not evidence of fraud, but here it sits alongside confirmed threat listings. The operator's real-world identity has not been independently established. No third-party broker or regulator record matched this domain, and that absence is neutral. The valid certificate is a basic domain-validated one. It encrypts traffic but says nothing about who runs the site. Evidence:

• Homepage: no named legal entity, licence, registry reference or physical address is visible.
• Hosting: served from AS13335 (Cloudflare, Inc., US).
• Transport security: TLS certificate issued by WE1 (DV), valid to 2026-12-13.
• Registration: the domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, with expiry set for 2027-07-17.

What to Verify Next

Anyone who encountered this site through a message, advertisement or social post should first trace that referral and treat it as untrusted until the sender is confirmed through an independent channel. The wallet's official application and web presence should be reached only through the publisher's own channels or a recognised app store, never through this domain. Anyone who has already entered a recovery phrase, password or wallet approval here should treat that wallet as compromised. They should move remaining assets to a newly created wallet and revoke existing approvals. Confirm the official support channels of the genuine wallet publisher independently. Evidence:

• Homepage: the wallet-style pitch is the only content captured, so there is nothing on the page that can substitute for independent confirmation.
• Reputation: the current malicious flags from multiple security vendors mean prior interactions should be assumed unsafe.
• Registration: the domain's very recent creation date means no long-standing public record supports its claims.

Summary Verdict

The overall posture is high risk. Confirmed blacklisting and independent malicious classifications from several security vendors define the assessment. Technical hygiene does not offset them, and the operator's identity is unverified. The site is not suitable for any sensitive or financial interaction.

Infrastructure Integrity

The site sits behind a Cloudflare CDN and web application firewall, and every observed address belongs to edge servers, so the origin server is not visible. That edge-only visibility prevents independent verification of where content is actually hosted. It can also mask rapid content swaps behind a stable address. The infrastructure is a mitigating factor only. It reflects mainstream, well-run hosting and does not offset the reputation findings.

Closing Assessment

The site should not be used for login, wallet connection, recovery-phrase entry or any payment. At most, passive viewing of the page is tolerable. Organisations should block or flag the domain and report the referral source.