Is xrpaynet.live a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Google, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a single-page landing site on the domain xrpaynet.live. Its page is titled "XRPayNet Allocation Live — Claim Your Tokens Now" and urges visitors to claim a token allocation. The name evokes the XRP and payments ecosystem, but the captured page shows no demonstrated affiliation with any established project. Its apparent purpose is to funnel visitors into a token-claim flow. No product, company, or business model is described, and that gives the site the profile of a promotional lure rather than an operating service.

Scam/Impersonation Risk

Contradictory signals are present, and they are severe. The site is blacklisted. A major browser-safety service classifies it under social engineering, and a large number of independent security engines, including several top-tier vendors, flag it as malicious. Together these triggered an automatic reputation ceiling that overrides every positive technical signal. This cannot be read as a mere reputational concern, because the detections come from several independent sources. No conflicting legal identities were found, and no confirmed impersonation of a specific named brand was established. The risk comes from the blacklist convergence combined with the "claim your tokens now" call to action, a framing typical of token-giveaway and wallet-solicitation lures. Behavioural testing of the homepage points the same way. Across all three sandbox runs, hidden forms were present, including password-type fields that a visitor cannot see. The page sent a large volume of background data to many third-party destinations that are not established infrastructure. Nearly all of its outbound traffic went to external parties. Its content also changed substantially after interaction, which is consistent with a page that assembles its real behaviour dynamically. Wallet-connection prompts, clipboard tampering, drainer behaviour, and cloaking were not observed in testing. That is an observation of the test runs only and does not offset the blacklist evidence. Evidence:

• Homepage: the title and call to action solicit a token allocation claim, with no accompanying description of the issuer or the project.
• Homepage behaviour: hidden forms, including hidden password fields, were detected in 3 of 3 sandbox runs. 12 external POST requests and 17 external XHR requests went to non-whitelisted destinations, and about 3,184 DOM mutations followed interaction.
• Domain provenance: registered 2026-07-09 (~0.3 years old, roughly 106 days). The web archive holds 1 snapshot, first seen 2026-07-12, with 1 year tracked, so the site has no history of legitimate operation.
• Reputation: the browser-safety classification and the multi-vendor malicious detections were both confirmed on the scanned domain.

Regulatory Verification Notes

The captured page makes no verifiable regulatory claim. It shows no licence, registered company, or named operator. Whether any on-page disclosure exists remains unclear. Ownership is opaque, and the registrant details are incomplete. A site that solicits token claims and asks for sensitive input normally carries identifiable corporate and compliance information, so this absence matters here. Taken alone, a missing licence is only a verification gap. In this case it adds to, and does not cause, the elevated risk assessment. No third-party broker or regulator record matched this domain, and that finding is neutral rather than reassuring. The domain is also not recognised in DeFi protocol-tracking directories, so it has no independent footprint as an established crypto project. Evidence:

• Registration: the domain is held through the registrar NICENIC International Group Co., Limited, with expiry set to 2027-07-09. Registrant detail is incomplete.
• Hosting: served from AS13335 (Cloudflare, Inc., US).
• Transport encryption: the TLS certificate is issued by WE1 at DV (domain-validation) level only and is valid to 2026-12-05. It confirms domain control, not the operator's identity.
• Directory recognition: the DeFi tracking lookup completed and returned no listing for this domain.

What to Verify Next

No interaction with the site is advisable. Anyone who believes an "XRPayNet" allocation is genuine should consult the project's announcements through channels reached independently of this site, for example by looking up the project through known, established sources rather than any link or message that led here. Anyone who has already visited the page should not have entered credentials, seed phrases, or payment details. If they did, they should change the affected passwords from a clean device, revoke any wallet permissions granted, and monitor the wallet and associated accounts. Any claimed licence or registration should be checked directly with the relevant regulator's public register. The check should use the regulator's own website and a name found there, not details supplied by this site. Anyone who encountered the domain through a message, advertisement, or social post should report that message to the platform on which it appeared. Evidence:

• Homepage: the token-claim call to action is the only functional element observed, so legitimacy depends entirely on what an independent source says about the project.
• Behavioural testing: hidden password-type fields were found, so any credential entered on the page is at risk even though it is not visibly requested.
• Reputation: the confirmed browser-safety and multi-vendor detections give a security basis for reporting the domain to the platform on which it was found.

Summary Verdict

The assessment is firmly adverse. Confirmed multi-source threat detections, young and unestablished provenance, and concealed form behaviour converge on a site that should be treated as hostile to visitors' interests until independent evidence shows otherwise. Whatever limited technical hygiene it displays does not alter that conclusion, and the real-world operator remains unidentified.

Infrastructure Integrity

The site is fronted by Cloudflare's CDN and WAF, and all four observed IP addresses are Cloudflare edge servers. The origin server was not observable. A valid TLS certificate from a mainstream issuer is in place. These protections are a mitigating factor only. They are available to any customer, including malicious operators, and they cannot offset the external threat detections. Edge-only visibility also prevents independent verification of the hosting and allows content to be swapped quickly without any visible infrastructure change.

Closing Assessment

Do not enter credentials, wallet details, seed phrases, or payment information on this site, and do not connect a wallet or approve any transaction from it. Anyone who has already done so should act on the remediation steps above promptly.