Verdict
This assessment found strong scam indicators. Do not pay, sign in, or share personal details with this site.
loyalty-xrpl.com shows high-risk / scam indicators.
Evidence status and limitations
Evidence completeness: Not recorded
- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.
At a glance
The checks that decide most of this verdict.
| Malware engines | 19 flagged itVirusTotal | Risk |
|---|---|---|
| Google Safe Browsing | Listed as unsafeGoogle | Risk |
| Abuse reports on the host | 0% confidenceAbuseIPDB, 0 reports; shared hosting inflates reports | Clear |
| Domain age | 2 months oldMost scam domains are under a year old | Risk |
| Web archive | Archived since 20263 snapshots | Clear |
| Certificate | Encrypted connectionIssued by WE1 | Noted |
The page as captured
Key findings
- Automated classification: Sensitive Interaction Risk.
- Domain age: less than 1 year (registration continuity).
- Public web-archive history exists since 2026.
- At least one reputation service TrustSniffer consulted had flagged this domain at assessment time.
Full analysis
Security Alert
Fortinet, Google, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.
This website presents itself as an "XRP Loyalty Rewards Program" with an "Eligibility Check" step on its homepage. Its domain name pairs loyalty-programme wording with "xrpl", shorthand for the XRP Ledger ecosystem. Its apparent purpose is to draw cryptocurrency holders into a reward-claim or eligibility workflow. The business model is not clearly stated, and the site shows no affiliation with any established XRP ecosystem organisation.
Scam/Impersonation Risk
Material contradictions are present. A major browser safe-browsing service currently classifies the domain under social engineering, and a substantial number of independent security engines, including several top-tier vendors, flag it as malicious. This is a confirmed blacklist condition, and it is the decisive factor in the assessment. No conflicting legal-entity names were observed, and the evidence does not establish brand impersonation. The reputational findings alone place the site firmly in a high-risk category. The "eligibility check" framing is a common lure format. Visitors are told they qualify for a token reward and are then steered toward wallet, credential or personal-data submission. The domain naming borrows XRP Ledger vocabulary without any evidenced link to a genuine project. In sandbox sessions, the page sent POST traffic to external destinations outside the trusted-service set. No wallet-drainer behaviour, clipboard hijacking, hidden forms or content cloaking were observed. The absence of those mechanisms does not offset the reputation findings, because a data-collection or redirect stage may be served selectively.
- Homepage: the page title advertises an "XRP Loyalty Rewards Program — Eligibility Check", a claim-gating lure format.
- Reputation: the domain is flagged for social engineering by a browser safe-browsing service and as malicious by multiple security engines, including several top-tier vendors.
- Domain provenance: registered 2026-09-03 through NICENIC INTERNATIONAL GROUP CO., LIMITED (~0.14 years old, about seven weeks), with registration running to 2027-09-03. The web archive holds only 3 snapshots, spanning 2026-09-11 to 2026-09-22 (1 year tracked).
- Sandbox behaviour: the homepage issued three outbound POST requests to non-whitelisted external hosts. All three runs returned stable responses with no cloaking.
Regulatory Verification Notes
No licence, registration number or regulated-entity status was established for this site, and the disclosure state of the captured homepage is unclear. The site markets a crypto-asset rewards scheme, so a financial-services authorisation would normally be expected. Its absence is a verification gap that sits beside the reputational findings and does not replace them. Ownership details are incomplete, which is an ownership-opacity limitation and not an identity contradiction. No third-party broker-database record matched this domain, so there is no additional reputational context from that source. The transport certificate is valid, but it is domain-validated only. It confirms control of the domain and says nothing about the legitimacy of the operator.
- Hosting: served from AS13335 (Cloudflare, Inc., US).
- Transport encryption: TLS certificate issued by WE1 (DV), valid to 2026-12-02.
- Homepage: no regulator, licence or registered-company reference was established.
What to Verify Next
No sensitive interaction is supported by the evidence. Any claim of an XRP loyalty or rewards programme should be checked only through official project channels reached independently of this site, such as channels the user locates directly and not through links on this domain. Anyone who has already visited and entered a wallet address, connected a wallet, signed a transaction or submitted credentials should review and revoke wallet permissions. They should also move assets to a freshly created wallet if a seed phrase was exposed, and change reused passwords. The operator's claimed authorisation, if any is later asserted, should be confirmed directly with the relevant financial regulator's public register. The official support or contact channels should be established through an independent offline route.
- Homepage: the reward-eligibility framing is the only programme claim observed, and no independent source corroborates it.
- Sandbox: outbound POSTs to non-whitelisted hosts mean any data entered may leave the site's own domain.
- Reputation: the current security-vendor flags mean the domain should be re-checked against reputation sources before any future reassessment.
Summary Verdict
The site reads as a high-risk, newly established web property whose reputation record is adverse and consistent across independent sources. The reward-claim positioning supports that assessment, and nothing in the evidence offsets it. Legitimacy cannot be credited, and the operator's real-world identity remains unestablished.
Infrastructure Integrity
The site sits behind Cloudflare's CDN and WAF, and every observed address is a Cloudflare edge node. The origin server is not observable, so hosting cannot be independently verified, and content can be swapped quickly behind the edge. This protective layer is a minor mitigating factor only. It does not offset the threat detections, and it says nothing about the operator's intent.
Closing Assessment
Treat the site as unsafe for any login, credential entry, wallet connection or financial interaction, and limit any contact to passive viewing from an isolated environment. Anyone who has already engaged with it should act promptly on the remediation steps above.
Written analysis generated 2026-10-25 by the TrustSniffer Analysis Engine from the evidence in this report.
What the analysis found
4 findings contributed to this verdict, raised by external reputation, hosting and network, history in the web archive, behaviour in a sandbox.
01 External reputation
- An external threat feed lists this domain: either Google Safe Browsing marked it malicious, or a significant number of malware engines flagged it.External reputation
rule:EXT_BLACKLIST_CRITICAL
02 Hosting and network
- The domain was registered less than three months ago.Hosting and network
rule:DNS_NEW_DOMAIN_90D - The domain is young and has almost nothing else set up around it.Hosting and network
rule:DNS_SPARSE_YOUNG_DOMAIN
03 History in the web archive
- The web archive has almost no record of this domain, which fits a site that is new.History in the web archive
rule:ARCH_PEN_YOUNG_AND_SPARSE
04 Behaviour in a sandbox
- A large share of what the page loaded came from other domains.Behaviour in a sandbox
rule:BEHAV_EXTERNAL_RATIO_MODERATE - The page sent data to a destination TrustSniffer does not recognise.Behaviour in a sandbox
rule:BEHAV_NONWHITELISTED_POSTS
Identity verification
| Status | UNKNOWN |
|---|---|
| Identity score | 50/100 |
| Identity verification confidence | 30% |
- AI page analysis unavailable (page captured; identity not AI-verified)
Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence.
What TrustSniffer observed
First-party facts recorded during the assessment of loyalty-xrpl.com.
- The request stayed on loyalty-xrpl.com. It was not redirected to another domain. Clear
- Registration is published under NICENIC INTERNATIONAL GROUP CO., LIMITED. Clear
- DNS for this domain is served by cloudflare.com, across 2 name servers. Noted
- The registration is paid up to 2027-09-03. Noted
- The earliest public archive of this site is from 2026-09-11. Clear
- It is hosted on CLOUDFLARENET, from a server in US. Noted
Domain intelligence
| Registrar | NICENIC INTERNATIONAL GROUP CO., LIMITED |
|---|---|
| Hosting | CLOUDFLARENET - Cloudflare, Inc., US |
| Country | US |
| Server IP | 2606:4700:3037::ac43:d2b6 |
| Name servers | RANDALL.NS.CLOUDFLARE.COM, TARA.NS.CLOUDFLARE.COM |
| CDN / edge network | Detected (cloudflare) |
| Resolved IP addresses | 4 |
| Edge IP addresses | 4 |
| Likely origin IP addresses | 0 |
| SSL issuer | WE1 |
| SSL expiry | 2026-12-02 |
| Domain age | 0.14 years (continuous registration) |
| Domain expiry | 2027-09-03 |
| Archive first seen | 2026-09-11 |
| Archive snapshots | 3 |
| Reputation | VirusTotal: 19 flagged | AbuseIPDB: 0% confidence, 0 reports | Google Safe Browsing: 1 match |
About this assessment
A trust score summarises the evidence TrustSniffer could collect about loyalty-xrpl.com at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.
TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.