Is xrp-scans.com a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

xrp-scans.com is a recently registered website whose name suggests an XRP-themed blockchain scanning or exchange-style service. When the site was visited, it returned a security interstitial titled "suspected phishing" in place of a normal homepage. The page carried only a short block of warning text, so the site's real offering, product claims and business model could not be seen. The only apparent purpose is what the domain name implies: a crypto-asset lookup or trading-adjacent service aimed at XRP users.

Scam/Impersonation Risk

Material contradictions are present. The site is blacklisted by multiple independent security sources: a large cluster of reputation engines, including several top-tier vendors, classify it as malicious, and a further group rate it suspicious. This convergence is decisive, and the posture is deliberately cautionary. It is reinforced by the interstitial served on the homepage, which labels the site as suspected phishing, and by the web-archive record, which marks the domain as previously associated with phishing. No brand impersonation or conflicting legal identities were identified, so these are reputational and threat-listing contradictions rather than identity contradictions. Behavioural testing found no wallet-connection prompts, clipboard tampering, hidden forms or credential posts to external destinations. The absence of those mechanics does not offset the blacklisting, and the page content that would show what the site actually asks of visitors was withheld behind the interstitial. The sandbox runs did record a very high share of external network activity (dozens of third-party XHR requests and several external POSTs) and a large number of console errors. These are consistent with an unstable or heavily third-party-dependent page, but they carry no independent weight beyond the threat listings. Evidence:

• Homepage: the captured page was a 403 interstitial titled "Suspected Phishing", and no genuine site content was served to the analysis.
• External reputation: 15 engines returned malicious and 3 suspicious verdicts, including three leading security vendors.
• Domain provenance: registered 2026-08-06 (~0.22 years, ~81 days old).
• Web archive: 128 snapshots spanning 2025-04-23 to 2025-04-28 (1 year tracked). These captures predate the current registration record, so the name existed before its latest registration.

Regulatory Verification Notes

No legal, terms, about or licensing pages were available in the captured content, so no licence, registration number or operating entity can be attributed to the site. The registrant details are incomplete, which is ownership opacity. This is an administrative limitation and is not treated as an identity contradiction. Real-world identity is unconfirmed, and no third-party broker or regulator profile matched the site. The mainstream TLS certificate and the registration through an established registrar do not amount to regulatory standing, and they do not offset the threat listings. Evidence:

• Registrar: the domain is registered through NICENIC International Group Co., Limited, with registrant details incomplete.
• Registration term: expires 2027-08-06, a one-year initial term.
• Hosting: served from AS13335 (Cloudflare, Inc., US).
• Transport encryption: the TLS certificate was issued by WE1 (DV, domain-validated only) and is valid to 2027-01-02.

What to Verify Next

Any claim that this site is linked to a known XRP exchange, wallet or explorer should be checked through that organisation's own official channels, reached independently of this site. The domain's current registration should be checked against public registry records, and the site should be reassessed only after the threat listings are formally cleared. A genuine operator would be expected to publish a verifiable legal entity and regulatory status. Official support and contact routes should be confirmed offline before any contact is made. Evidence:

• Homepage: the interstitial blocks any review of what the site offers, so affiliation claims cannot be tested from the site itself.
• Registration record: the one-year initial term and incomplete registrant details give no basis for tying the domain to a named operator.
• Reputation record: the threat listings remain active, so no clean re-evaluation is possible yet.

Summary Verdict

The assessment is a critical-risk posture. Active detections by multiple independent security sources, a phishing warning shown on the homepage and a young domain with undisclosed ownership converge on elevated risk. Technical hygiene and a valid certificate cannot outweigh that reputation evidence, and legitimacy cannot be inferred from them.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and WAF, and all observed addresses are edge servers, so the origin host was not seen. This protection is only a mitigating factor. It shields the origin from direct exposure, but it also prevents independent verification of where content is actually hosted, and it cannot offset the external threat detections. A heuristic flag for a young domain with sparse subdomains is unconfirmed and carries little weight.

Closing Assessment

The site should not be used for login, credential entry, wallet interaction or any financial activity, and nothing should be downloaded from it. Any contact with it should be limited to passive, read-only viewing from an isolated environment. Anyone who has already entered credentials or connected a wallet should change those credentials and revoke wallet permissions immediately.