Is phase2-xrpl.live a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website, phase2-xrpl.live, is a very recently launched .live domain whose name points to the XRP Ledger and crypto ecosystem. In analysis, visitors were met by a security interstitial titled as a suspected-phishing warning instead of a normal landing page, and only a few hundred characters of page text were captured. Its apparent purpose could not be established from the content, and no business model, product set or operator identity is evident.

Scam/Impersonation Risk

The assessment is clearly cautionary because confirmed reputational contradictions are present. The domain is on external blacklists, and several independent security engines classify it as malicious, with more flagging it as suspicious. This agreement across sources, together with the interstitial a protective network layer serves to visitors, is the decisive risk factor. No conflicting legal identities and no explicit brand impersonation were observed, so the concern comes from threat listings, not from contradictory corporate claims. The domain is also only a few months old and has almost no independent historical footprint, which gives the listings no established reputation to offset them. Sandbox behavior shows no wallet-drainer activity, clipboard manipulation, hidden forms or external password submission. That absence does not outweigh the threat listings, because the page was gated and its full content could not be exercised. The crypto-themed name and the gated, short-lived footprint match the profile of a staging or lure domain that could later host credential or wallet flows. Evidence:

• Homepage: the capture returned a bot-challenge response carrying a suspected-phishing title, with only about 400 characters of text.
• External reputation: five security engines rate the domain malicious and two suspicious, and blacklist status is confirmed.
• Domain provenance: registered 2026-07-11 (~0.29 years old); the web archive holds 1 snapshot (first and last seen 2026-07-12, 1 year tracked).
• Sandbox: 3 of 3 runs completed with 37 external XHR requests and 9 external POSTs, all to known services; 26 console errors; no wallet-connect, clipboard or hidden-form activity.

Regulatory Verification Notes

The captured homepage content names no legal entity and cites no license or registration. Registration details are incomplete, so the operator's ownership is opaque. This is an ownership-opacity condition, not an identity contradiction, and by itself it would not indicate wrongdoing. Here it adds to an already adverse reputation picture and leaves no corporate counterparty to hold accountable. No third-party broker or regulator listing for this domain was found, so no claim of regulated status can be credited. The valid transport-encryption certificate is domain-validated only, so it confirms an encrypted connection but nothing about the operator's identity or legitimacy. Evidence:

• Homepage: no company name, license number or regulator reference appears in the captured text.
• Registrar: NICENIC INTERNATIONAL GROUP CO., LIMITED; registration runs from 2026-07-11 to 2027-07-11 with incomplete owner details.
• Transport encryption: TLS certificate issued by WE1 (DV), valid to 2026-12-07 (about 41 days remaining).

What to Verify Next

Anyone who reached this site through a message, advertisement or social-media post should treat that source as suspect and trace it. Any association with the XRP Ledger or a related project should be checked on that project's official channels, which should be reached independently of this domain. If wallet approvals were granted, seed phrases were entered or credentials were submitted after visiting, the affected wallets and accounts should be secured immediately by revoking approvals and rotating credentials. Any licensing or registration claims the operator makes should be confirmed with the relevant financial registry. The domain should be re-examined only after the listings are formally cleared. Evidence:

• Threat listings: the blacklist and multi-engine detections remain active at the time of analysis.
• Homepage: no verifiable operator, project affiliation or official contact route was observable.
• Domain age: the registration is under four months old, so no track record exists to rely on.

Summary Verdict

The overall posture is high risk. Confirmed external threat detections dominate the assessment, and the domain's youth and ownership opacity leave nothing to counterbalance them. Technical hygiene such as valid encryption and a clean sandbox does not outweigh this. The site cannot be treated as trustworthy for any sensitive purpose.

Infrastructure Integrity

The site is served through Cloudflare's CDN and WAF (AS13335, US, registry ARIN). All four observed addresses are edge servers, and the origin host was not observable. This protection is a mitigating factor only, and it also prevents independent verification of where the content is actually hosted. Edge-only visibility can mask rapid content changes, so it offers no assurance about legitimacy and cannot offset the threat listings.

Closing Assessment

The site should not be used for logins, credential entry, wallet connections or any financial transaction. Any contact should be limited to passive viewing from an isolated environment, and the domain should be avoided entirely until the threat listings are formally lifted.