Is phase1-xrpl.live a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

The website phase1-xrpl.live is a recently created site on the .live top-level domain. Its name suggests a link to the XRP Ledger ecosystem, but no readable commercial content could be retrieved. Visitors are met with a warning page labeled as suspected phishing, so no products, services, or business model can be attributed to it from direct observation.

Scam/Impersonation Risk

Material contradictions are present, and they are decisive for this assessment. The domain is blacklisted by multiple independent threat-intelligence sources. Several top-tier security engines flag it as malicious, which triggered an automatic suppression of the site's standing. The site's own homepage returns a phishing-warning interstitial rather than ordinary content, and the domain is recorded in historical intelligence as a known phishing resource. The domain also carries an XRP Ledger-themed name on a very young registration. That combination is a recognised pattern for lures aimed at cryptocurrency holders, such as fake claim, airdrop, or wallet-connection flows. No brand impersonation or conflicting legal identities were confirmed. The risk rests on the external detections, not on any observed on-page content. Behavioural testing found no wallet-connection attempts, clipboard manipulation, or hidden forms. These absences do not offset the threat-intelligence verdict. They also may reflect the access gating that kept the real page from being rendered. Sensitive interaction should be treated as unsafe.

Regulatory Verification Notes

No independent regulator or registry association exists for this site, and no third-party broker-reputation record matched it. A licensing or disclosure assessment of its pages cannot be meaningful while the site is under active threat listing. Registrant details are withheld or incomplete. This is ownership opacity, not an identity contradiction. It prevents any real-world operator being connected to the domain, and the available evidence does not establish identity. The domain was registered through NICENIC International Group Co., Limited and carries a domain-validated certificate, which proves only control of the domain name and says nothing about the operator's legitimacy.

What to Verify Next

Before any engagement, the owner of the domain should be established through independent means. This means identifying the organisation that claims to run it and confirming that claim through channels not linked from the site itself. Any wallet, token claim, or airdrop message that points here should be checked directly against the official channels of the XRP Ledger project or service it purports to represent. Other recipients of the same link should be asked where it came from. Anyone who has already interacted with the site should review wallet approvals and revoke any that were granted. They should also change any credentials entered and monitor their accounts. A reliable source should confirm that threat listings have been cleared before the site is reassessed, and the official support and contact channels of any related brand should be confirmed.

Summary Verdict

Available evidence places this website in an elevated-risk category, with a clearly cautionary posture. Convergent threat-intelligence detections, a very recent registration, and the absence of any independently verifiable operator outweigh the technical hygiene signals the site displays. No evidence-based basis exists to treat it as legitimate, and its identity remains unverified.

Infrastructure Integrity

The site is fronted by Cloudflare's CDN and web-application firewall. Every observed address is an edge node, and the true origin server is not visible. Edge-level protection is treated here as mitigating only, since it neither proves legitimacy nor offsets the reputation risk. Cloudflare's bot-challenge layer blocked page retrieval and served its own phishing-warning page. The lack of origin visibility prevents independent hosting verification and could mask rapid content changes. Behavioural runs completed successfully with healthy interaction timing, but a high share of external requests, repeated console errors, and large DOM changes after interaction added noise without outweighing the verdict.

Closing Assessment

The site should not be used for login, credential entry, wallet connection, or any financial interaction. Links to it should be treated as hostile, and nothing should be downloaded from it. If it must be examined, that should be done only from an isolated environment, without any personal or wallet credentials.