Is xrpl-tokens.live a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

The domain xrpl-tokens.live is a very recently registered website whose name points to tokens on the XRP Ledger. Its content could not be reviewed. The automated visit to its homepage was stopped by the hosting edge provider, which served a short interstitial warning page titled "suspected phishing" instead of the site's own content. No products, token offerings, yields or stated business model could be extracted. Its apparent purpose, a crypto-asset or token-related service, is inferred from the domain name alone.

Scam/Impersonation Risk

Active contradictions are present, and the assessment is cautionary. The domain is blacklisted. Multiple independent security engines classify it as malicious, including a major network-security vendor, and an aggregate external blacklist confirms the listing. The interstitial shown at the homepage independently labels the site as suspected phishing, and the prior phishing history attached to the domain reinforces that. No contradictory legal identities were found, and no specific brand impersonation was established. The risk is driven by the confirmed reputational listings, not by an identified counterfeit target. Sandbox runs of the site recorded no wallet-connection prompts, wallet-drainer behavior, clipboard manipulation, hidden forms or externally posted password forms. Because the captured page was a challenge screen, that clean behavioral result says little about what the real site does once a visitor passes it. Network behavior was heavy: the pages generated a large volume of requests to external destinations, including multiple external POST submissions, though none went to unrecognized endpoints. The console also logged many script errors. Together with a domain registered only months ago, this fits a disposable, quickly assembled property better than an established project. For a name that evokes a crypto-token ecosystem, that is the profile through which wallet-approval or credential-harvesting abuse is typically staged. Evidence:

• Homepage: capture was blocked with an access-denied response, and the page title read "suspected phishing", which is a warning interstitial and not site content.
• Homepage: multiple security engines flagged the domain as malicious and one more as suspicious, and an external blacklist hit was confirmed.
• Domain registered 2026-07-11 (~0.29 years old); the web archive holds 1 snapshot, dated 2026-07-12 (1 year tracked).
• Sandbox behavior across 3 runs: 33 external XHR requests and 9 external POSTs, 22 console errors, and no wallet-connect, drainer or clipboard events.

Regulatory Verification Notes

No licensing, registration or legal-entity information could be assessed. The homepage content was not retrievable, so no legal, terms or about pages were reviewed, and the on-page disclosure position remains unclear. The real-world operator is not connected to any known organization or person, and no third-party regulatory or broker record matches this domain. Ownership details are incomplete at the registration level, which is an administrative limitation and not an identity contradiction. A token-oriented service that invites deposits, swaps or wallet interactions would ordinarily need to show who operates it and under which authority. That evidence is absent here, and it cannot offset the confirmed threat listings. The site's transport encryption is valid but is a domain-validated certificate only. It confirms an encrypted channel to the domain and says nothing about the operator's legitimacy. Evidence:

• Registrar of record is NICENIC INTERNATIONAL GROUP CO., LIMITED; registration runs 2026-07-11 to 2027-07-11 (one-year term).
• TLS certificate issued by WE1 (DV), valid to 2026-12-08, with 42 days remaining.
• Served from AS13335 (Cloudflare, Inc., US).
• No regulator or broker-database match was returned for the domain.

What to Verify Next

Any claim that this site belongs to an XRP Ledger project, issuer or exchange should be tested through the project's own channels, reached independently of this domain, such as an established listing or an official account found by other means. If the site presents itself as offering financial or trading services, the claimed operator and any claimed licence should be checked directly with the relevant regulator's public register. Official support and contact channels should likewise be confirmed through a separate, trusted route. The domain should be rechecked only after the current threat listings have been formally cleared. Anyone who has already connected a wallet, signed a transaction or entered credentials here should revoke token and wallet approvals, move assets to a fresh wallet, and rotate any reused passwords. Evidence:

• Homepage: the warning interstitial and the confirmed listings mean no on-site claim can currently be taken at face value.
• The domain is under four months old, so there is no long operating record to corroborate an association with any established project.
• Identity checks returned no independent connection between the domain and a real-world brand or person.

Summary Verdict

The available evidence supports an elevated-risk posture. Confirmed blacklisting, a phishing warning at the homepage and the prior phishing history all point the same way. The site's very recent creation and the absence of any independent link to a known operator remove the mitigating context that would otherwise temper those findings. Nothing observed supports treating the site as legitimate.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and web application firewall. All four observed addresses are edge servers, and the origin host could not be observed. A bot-protection challenge intercepted the automated visit. The valid certificate and recognized hosting network are mitigating factors only. They show that the site is configured competently, not that it is trustworthy, and they cannot offset the external threat detections. Edge-only visibility also prevents independent verification of where the content is hosted.

Closing Assessment

The site should not be used for login, wallet connection, token approvals, credential entry or any payment or financial transaction. At most, non-interactive, read-only viewing from an isolated environment is acceptable. Contact with the domain should be avoided until the threat listings are formally cleared and the operator is independently identified.