Is xrp-paperhand.com a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a single-page, XRP-themed novelty site titled "PAPERHAND — How much did you fumble?". It presents a short, text-light landing page built around the "paperhand" meme, in which a visitor is invited to see how much they supposedly lost by selling early. The page carries no visible company, product catalogue, or service description. Its apparent purpose is audience engagement around the XRP community, and the operator's business model could not be established from the content captured.

Scam/Impersonation Risk

The most serious finding is a confirmed blacklist presence. A substantial group of independent security engines currently classes the domain as malicious, and several of the best-known endpoint-security vendors are among them. Blacklisting by this many separate sources is a strong external corroboration that the site is associated with harmful activity, and it is decisive for the risk posture. No brand impersonation and no conflicting legal identities were observed, so the contradiction rests on the blacklist evidence. The domain is also very young, which is typical of short-lived campaigns that borrow a popular cryptocurrency theme to attract traffic. Behavioural testing of the homepage showed no wallet-connection prompts, no wallet-drainer behaviour, no clipboard manipulation, and no cloaking. Those results are mildly reassuring, but they do not offset the external detections. The homepage did, however, send several data submissions to third-party destinations outside the site's own and commonly trusted services, which is unusual for a page with so little visible functionality and leaves the recipient of any visitor data unexplained. The security engines' flags are a reputational signal about the domain. Page-level analysis could not independently establish the nature of the threat, and the evidence does not support asserting a specific attack type.

Regulatory Verification Notes

The captured homepage discloses no legal entity name, licence, registration number, or terms of use. That is a genuine content gap rather than a tooling artefact. The site is not positioned as a regulated financial service, and no third-party regulatory or broker-database record could be matched to it. The real-world operator identity therefore remains unverified, and the on-page text offers nothing from which it could be established. The registration record is incomplete as to the owner, which is an ownership-opacity condition and not an identity contradiction. The transport encryption is a basic domain-validated certificate. It confirms only an encrypted connection and says nothing about who operates the site or whether it is safe.

What to Verify Next

Because the domain is blacklisted, verification should focus on whether the site has any genuine link to an XRP project or community, and on whether its listing status changes. Any claim of affiliation should be checked through the official channels of the project concerned, reached independently of this site, not through links or handles it presents. The domain's listing status with major security vendors should be re-checked after a reasonable interval, since remediation or further detections would change the picture. Any prompt on the site to connect a wallet, sign a transaction, or enter credentials should be treated as out of bounds until the listings are resolved.

Summary Verdict

The evidence places the site firmly in a high-risk category. Strong external threat detections, a very recent domain, and an unverified operator outweigh the technically orderly encryption and the absence of overt wallet-draining behaviour. Its legitimacy cannot be accepted on the available evidence, and its operator identity remains unestablished.

Infrastructure Integrity

The site is fronted by Cloudflare's CDN and WAF, and all observed addresses are edge servers. The origin server was not observable, which limits independent hosting verification and can make rapid content changes harder to detect. The use of a mainstream, reputable edge provider is a mitigating factor only. It does not indicate legitimacy and cannot offset the reputational risk established above.

Closing Assessment

Browsing should be limited to read-only viewing, if it happens at all. No login, credential entry, wallet connection, or financial interaction is appropriate, and nothing should be downloaded from the site. Organisations should consider blocking the domain at the web-gateway or DNS level until its external listings clear and its operator has been independently identified.