Is wxrp.vercel.app a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

A single-page crypto bridge application hosted on a free developer-platform subdomain, presented as "wXRP Bridge", which offers to wrap native XRP from the XRP Ledger into a wrapped token (wXRP) on Solana and to redeem it back. The page invites visitors to connect XRP Ledger wallets (Xaman, Crossmark, Ledger hardware) and Solana wallets (Phantom, Backpack, Solflare, WalletConnect), send native XRP to a custody address, and receive wXRP through a LayerZero omnichain token mechanism. Its apparent business model is a per-transfer bridge fee of roughly 0.01 XRP, plus an optional swap feature, with user value held by a third-party institutional custodian.

Scam/Impersonation Risk

Contradictory signals are present, and they are confirmed rather than speculative. The site is blacklisted: a major browser-safety service flags it under a social-engineering category, and multiple independent security engines, including a tier-one vendor, classify it as malicious. These detections do not specify the exact mechanism, but together they are decisive and override every mitigating technical attribute. No conflicting legal identities and no explicit brand impersonation were confirmed. The danger comes from the page's own mechanics. It asks visitors to send native XRP to a custody address and to sign transactions, which are irreversible fund-transfer actions, and it supports no claim with checkable proof. It asserts "1:1 backed" reserves, "$100M+ initial liquidity" and "70+ LayerZero chains" without a published custody address, proof of reserves, audit or contract reference. It also labels the experience "Non-custodial" while stating that funds sit in Hex Trust custody, and it claims "no trust assumptions" while requiring complete trust in that custodian. That internal contradiction is a hallmark of fund-collection pages. The interface shows a pre-populated balance of 1,250 XRP before any wallet is connected, which is cosmetic content that makes the tool look operational. Behavioral testing recorded external requests, including three data submissions to unrecognised third-party destinations. It did not observe wallet-drainer routines or clipboard tampering, but that absence does not offset the blacklisting. Evidence:

• Homepage: the bridge interface states "1:1 backed", "$100M+ initial liquidity" and "70+ LayerZero chains" with no supporting reserve, audit or contract documentation.
• Homepage: the footer label "Non-custodial UX" sits beside "Hex Trust custody", and the page also claims "no trust assumptions".
• Browser-behavior testing: three external data submissions to non-allowlisted destinations across three runs, with wallet-connect, custody-transfer and transaction-signing prompts.
• Domain registered in 2026 (~0.44 years old); 4 archive snapshots spanning 2026-05-12 to 2026-10-14 (1 year tracked), consistent with a very young deployment.

Regulatory Verification Notes

The site discloses no legal entity, registered address, license number or working contact channel, and no terms, privacy or about pages were captured. Ownership and governance are opaque. Its statements that custody is "regulated" and "licensed" name no regulator and no registration, so they cannot be treated as regulatory standing. The operator is unidentified, and the shared platform subdomain supplies no organisational identity of its own. No third-party broker or regulator record matched the site, and no entry was found in a DeFi protocol directory, so no external source corroborates the project or its claimed liquidity. This section records the disclosure and licensing gap as a verification matter. The scam-risk conclusion above rests on the confirmed security detections. Evidence:

• Homepage: custody is described as "Hex Trust regulated" with no regulator, license number, legal entity or contact detail.
• Homepage and page content: no terms, privacy policy, about page or support channel is present.
• Transport layer: TLS certificate issued by WR1 (DV, domain-validated only), valid to 2026-11-27 (37 days remaining); DV encryption confirms nothing about the operator's identity.
• Hosting: served from AS16509 (AMAZON-02 - Amazon.com, Inc., US).

What to Verify Next

Any assessment of the project's claims should start from sources independent of the page. The named custodian should be contacted through channels taken from its own official materials, to confirm whether it holds XRP for this bridge and whether the custody address is genuine. The token contract and the LayerZero configuration should be matched against announcements from the XRP Ledger or Solana projects the bridge claims to serve. A named regulator's public register should be checked for the claimed license. A published proof-of-reserves or audit report should be located. Official support and contact channels should be confirmed offline rather than through the page. Evidence:

• Homepage: no custody address, contract address, audit link or reserve attestation is published to check against.
• Homepage: the custodian is named, but the page links to no verifiable agreement with it.
• Page content: the claimed "regulated and licensed" status carries no regulator name or registration reference.

Summary Verdict

The evidence converges on a high-risk, cautionary posture. Confirmed security detections, a very young and unidentified deployment, and unsubstantiated financial claims that contradict one another outweigh the technically valid transport security. Legitimacy cannot be inferred, and the operator's real-world identity remains unverified.

Infrastructure Integrity

The site sits behind a trusted CDN edge layer on a major cloud provider, with every observed address belonging to edge servers and no origin address observable. This is a mitigating factor only. It means the hosting is mainstream and professionally run, but it also prevents independent verification of the actual backend and allows content to be swapped quickly without visible infrastructure change. Reports of abuse recorded against one shared edge address belong to the hosting provider's multi-tenant network, not to this site specifically, and they were discounted accordingly. Infrastructure quality does not offset the confirmed threat detections.

Closing Assessment

The site should not be used for any financial interaction. Wallets should not be connected, transactions should not be signed, and no XRP or other assets should be sent to the addresses it presents. Any contact with it should be limited to read-only viewing, and anyone who has already interacted with it should review and revoke wallet permissions and move remaining assets as a precaution.

Signals weighed against the site

• AbuseIPDB: 83 reports on hosting IP 216.198.79.3 (Vercel, Inc, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.