Is vet-xrplf.com a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a single-page landing site titled "VET XRPL Legacy Rewards — Verify & Claim Your Allocation". It invites visitors to check their eligibility for a cryptocurrency reward tied to the XRP Ledger ecosystem and to claim an allocation. Its apparent purpose is a token-distribution or reward-claim funnel, a format that depends on visitors acting on an unsolicited promise of value.

Scam/Impersonation Risk

Contradictory signals are present, and they are decisive. Several independent security engines currently flag the domain as malicious, and a further group rates it suspicious, which amounts to a confirmed blacklist-level detection. The domain was registered only weeks ago, and the page uses a "verify & claim your allocation" lure. This is a recurring pattern in reward-claim campaigns that push visitors to authorize transactions or surrender wallet or account details. The domain name pairs a "vet" prefix with an XRPL-style suffix. That reads as an attempt to borrow the credibility of an existing ecosystem, although no specific brand impersonation or conflicting legal identity was established. In the behavioural sandbox, the page sent several POST requests to non-allow-listed external destinations, and most of its network activity went to third parties. Data submitted on the page may therefore leave the site's own domain. No wallet-connection prompts, clipboard manipulation, hidden forms or cloaking were observed in the sandbox runs. That does not offset the reputation findings, because a claim funnel can change its behaviour after a visitor engages.

Regulatory Verification Notes

The homepage identifies no operating company, registration number, licence or accountable individual. Ownership is opaque, and nothing connects the site to a real-world organisation, so no operator identity can be treated as established. No third-party broker or regulator record matched the site. The absence of a licence is a disclosure gap and not proof of wrongdoing, but here it sits alongside confirmed adverse detections. The domain is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. The encryption certificate is basic domain-validated and proves only control of the domain, not the identity of the operator.

What to Verify Next

Before any interaction, confirm independently whether any legitimate "legacy rewards" programme exists. Use only the official channels of the XRP Ledger projects and organisations the page alludes to, reached by manually typed addresses or known bookmarks, not by anything on this site. Independent confirmation by the named projects that a programme exists and that this domain belongs to it should be the minimum bar. Anyone who has already entered information on the page should treat the affected wallets and accounts as exposed, rotate credentials and revoke any token approvals. Any official support or contact channel should also be confirmed through an independent route.

Summary Verdict

The overall posture is critical and clearly cautionary. Confirmed adverse threat detections, a very recently created domain and an unverified operator behind a reward-claim lure converge on elevated risk. The legitimacy signals that are present, such as a valid certificate and a stable page response, are routine technical hygiene and do not offset the reputational and provenance findings.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and web application firewall, and all four observed addresses are Cloudflare edge servers. The origin server was not observable, so the real hosting location cannot be independently confirmed. That also means content could be swapped quickly behind a stable front. This protective layer is a mitigating factor only and gives no assurance about the operator's legitimacy. A heuristic flag for a young domain with sparse subdomains is consistent with the registration profile, but it is unconfirmed and carries little weight.

Closing Assessment

The site should be treated as unsafe for any login, credential entry, wallet connection, transaction signing or payment. If it is opened at all, it should be viewed passively and from an isolated environment. Organisations should consider blocking the domain and reporting it to their security team and relevant abuse channels.