Is xrpl-promotion.net a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Google, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website presents a single promotional page titled as a "Brad Garlinghouse 100,000,000 #XRP Reward Program". It uses a domain name styled to suggest an XRP Ledger promotion and invokes a named public figure from the XRP ecosystem. Its apparent purpose is a cryptocurrency reward or giveaway campaign, a format commonly used to attract visitors with the promise of free digital assets.

Scam/Impersonation Risk

Contradictory signals are present, and they are decisive. The site is blacklisted: a major browser safety service classifies it under its social-engineering category, and a large cluster of independent security engines rate it malicious, including several top-tier vendors. This is a confirmed blacklist condition, not a soft reputational signal. The page is built around a large XRP "reward program" attributed to a named industry executive. The lure pairs an outsized token amount with a public figure's name, a pattern characteristic of giveaway-style social engineering. The evidence does not independently establish who operates the site or whether it is formally impersonating that individual. It does show that the page's central claim is unverified and sits on a domain that security providers already treat as hostile. Automated sandbox runs observed no external network calls, wallet-connection prompts, or cloaking. This behaviour does not offset the external detections, and it does not show that a later interaction step is harmless. Two abuse reports also exist for the shared hosting address. They apply to shared provider infrastructure and are weaker context than the vendor detections. Evidence:

• Homepage: the page title advertises a 100,000,000 XRP reward program attributed to a named public figure, with no independently verifiable basis for the claim.
• Domain registered 2026 (~0.16 years old, about 57 days); web archive holds 1 snapshot from 2026 (1 year tracked), so there is no history of legitimate prior use.
• Reputation checks: a major browser safety service lists the domain for social engineering; 13 security engines flag it malicious and 3 suspicious, including four top-tier vendors.
• Hosting address: 2 abuse reports on shared data-centre infrastructure, which are secondary to the domain-level detections.

Regulatory Verification Notes

The homepage that was captured offers no licensing, registration, or corporate-identity disclosure that could tie the promotion to a regulated issuer or a recognised ledger foundation. The apparent claim of a reward program from a named executive therefore has no documented backing. No third-party broker reputation record matched this domain. The registrant details are masked through a privacy service at the registrar, which is a routine administrative arrangement and is not treated here as an identity contradiction. The absence of any verifiable operator identity matters more than usual because of the site's blacklist status and its use of a public figure's name. Evidence:

• Homepage: the captured page contains no disclosed legal entity, licence, or registration number.
• Registrar record: domain registered through Dynadot, with registrant details held by its privacy service; registration valid to 2027-08.
• Transport encryption: TLS certificate issued by YR1 at domain-validation (DV) level, valid to 2026-12; this proves only control of the domain, not the operator's identity.

What to Verify Next

Any claim that this reward program exists should be checked directly against the named individual's and the company's official channels, using addresses typed manually and not reached through this site. Internal security and fraud teams should treat the domain as a blocklist candidate and review any prior traffic, referrals, or user interactions with it. If users or customers received this link through email, social posts, or messaging, the delivery channel should be traced and reported to the platform concerned. Evidence:

• Homepage: the reward claim should be compared with announcements on official corporate and social accounts.
• Web archive: a single 2026 capture shows no earlier legitimate use that could support the claim.
• Reputation listings: the active security detections can be re-checked after any remediation claim from the operator.

Summary Verdict

The evidence converges on an elevated-risk, clearly cautionary assessment. Confirmed external threat detections, a very recently created domain, and a promotional lure built on a public figure's name outweigh the technically valid transport encryption and the quiet sandbox behaviour. The operator's real-world identity remains unverified, and nothing supports treating the site as a legitimate reward programme.

Infrastructure Integrity

The site resolves to a single address at a data-centre hosting provider in Russia, served from AS29182 (RU-JSCIOT). No CDN or WAF is in front of it, so there is no protective layer to mitigate the reputation concerns. The hosting country does not match the registry's expected geography. This is an unconfirmed heuristic that adds only modest weight. Together with a young domain and a sparse subdomain footprint, it is consistent with recently stood-up infrastructure.

Closing Assessment

The site should not be used for login, wallet connection, credential entry, or any financial interaction, and no file or instruction from it should be acted on. At most, it may be viewed in a read-only, isolated context for analysis, and the link should be reported and blocked wherever it circulates.

Signals weighed against the site

• AbuseIPDB: 2 reports on hosting IP 82.202.171.139 (JSC Datacenter, Data Center/Web Hosting/Transit), 1% confidence. The reports are attributed to shared infrastructure, not specifically to this website.