Is xrpl.live a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

The website at xrpl.live presents a landing page titled "XRP Ledger Home | XRPL.org", which is the title of the XRP Ledger project's home page, so it appears to be an informational or portal-style page for the XRP Ledger ecosystem. The captured page returned normal content and no specific products, yields, or commercial offers were evidenced. Its apparent purpose is therefore to present itself as a gateway to that project, and the site's own operator and business model are not established.

Scam/Impersonation Risk

Contradictory signals are present, and they are the decisive factor in this assessment. A major browser-security reputation service currently flags the domain for social engineering, and a leading antivirus vendor independently classifies it as malicious. Together these amount to a confirmed blacklist condition, not a soft reputational signal. The domain also carries a page title that mirrors that of the established XRP Ledger project's home page while operating under a different domain name. This matches a recognised impersonation pattern, although no on-page brand claims or conflicting legal identities were captured that would independently confirm impersonation. The domain's registration is only days old, whereas the web archive shows captures of the same name going back several years. That sequence is consistent with a previously used or lapsed name that has been re-registered and repurposed, and it raises the risk that content has changed hands. Behavioral testing showed the page sending several background requests and form-style submissions to external destinations outside the expected set of trusted services, and three console errors. It did not show wallet-connection prompts, clipboard manipulation, hidden forms, or cloaking. The site should therefore be treated as hostile until the listings are cleared, even though the behavioral tests did not catch a specific drainer. Evidence:

• Homepage: the page title replicates "XRP Ledger Home | XRPL.org" on the unrelated xrpl.live domain.
• External reputation: a browser-security service flags the domain for social engineering, and one tier-one antivirus vendor flags it as malicious.
• Domain registration: registered 2026-10-06 (~0.04 years old, 15 days at the time of analysis).
• Web archive: 7 snapshots spanning 2021-12-30 to 2026-10-13 (6 years tracked), which conflicts with the fresh registration date.

Regulatory Verification Notes

The captured homepage established no licensing status, corporate registration, or accountable legal entity. Registration data is incomplete, so ownership opacity applies and the real-world operator cannot be tied to the XRP Ledger project or to any other named party. This opacity is not an identity contradiction in itself, and no conflicting legal entities were observed. In a context where the site has already been flagged by external reputation sources, however, the absence of any accountable party removes the usual mitigating assurance. No third-party broker or regulatory-database entry corresponds to this site, and nothing here should be read as a licensing or regulatory finding. The domain is registered for a one-year term only, and the TLS certificate is a basic domain-validated one, which confirms control of the domain but nothing about the operator's identity. Evidence:

• Registrar: NICENIC INTERNATIONAL GROUP CO., LIMITED; registration expires 2027-10-06.
• TLS certificate issued by WE1 (DV), valid to 2027-01-08; domain-validation only.
• Hosting network: AS13335 (Cloudflare, Inc., US).
• Homepage: no licence, registration number, or named operating entity was identifiable in the captured content.

What to Verify Next

Before any interaction, the link or domain should be compared against the XRP Ledger project's official address, obtained independently through a trusted offline or previously known route and not through this site or a link pointing to it. The status of the external listings should be rechecked directly with the issuing security services, as a delisting would materially change the posture. Anyone who has already visited the site and entered credentials, signed a transaction, or approved a wallet connection should review recent wallet approvals and rotate affected credentials. Any official support or contact channels should be confirmed through the genuine project's own communications. Evidence:

• The domain's registration date and the multi-year archive history do not agree, which supports checking for a change of ownership.
• Behavioral testing recorded 3 non-whitelisted outbound POST submissions and 6 external XHR/fetch requests, so data entered on the page may leave the domain.
• The page title matches an established project while the domain differs, so any link or QR code leading here needs independent confirmation.

Summary Verdict

The overall posture is critical and clearly cautionary. Independent external threat detections, an impersonation-style naming pattern, and a registration history that does not fit the domain's earlier archive presence converge on a high-risk conclusion. The technically clean sandbox behavior and the valid certificate do not outweigh these signals, and the apparent legitimacy that a polished project-style page might suggest is not supported.

Infrastructure Integrity

The site is served through Cloudflare's CDN and WAF, and every observed address is a Cloudflare edge address, so the real origin server is not visible. This is a mitigating factor for availability and basic transport hygiene, but it neither establishes legitimacy nor offsets the reputation risk. Edge-only visibility also means that the underlying content can be changed quickly without any change in the externally visible hosting.

Closing Assessment

The site should not be used for login, wallet connection, credential entry, or any financial or transactional activity. At most, it warrants passive viewing from an isolated environment, and any information about the XRP Ledger should be taken only from sources reached through independently verified channels.