Is Xrpsrlusd a scam? TrustSniffer's high-risk assessment of xrpsrlusd.info: 0/100

Security Alert

Fortinet, Google, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

xrpsrlusd.info is a recently registered .info website whose name evokes the XRP and RLUSD crypto-asset tickers, which suggests a cryptocurrency-themed purpose. When automated analysis visited the homepage, it received an access-challenge page titled as a suspected-phishing warning instead of site content. The site's real offering and business model therefore could not be observed. The page that did load was a short text interstitial, and the domain has also been flagged by several major security vendors.

Scam/Impersonation Risk

Confirmed contradictory signals are present, and this is the decisive element of the assessment. The domain is currently blacklisted by multiple independent reputation sources. A leading browser-safety service classifies it under social-engineering abuse, the category used for phishing and deceptive-site warnings. A broad panel of security engines also returns malicious verdicts, including several tier-one vendors. The ticker-style name strongly implies a crypto-asset theme, which is a common lure for credential and wallet-targeting campaigns. However, no identity contradiction between legal entities was observed, because no legal or identity pages were reachable. Sandbox behavioral testing found no wallet-connection prompts, no clipboard manipulation, no hidden forms and no credential posts to non-whitelisted hosts. These absences do not offset the independent threat detections. The page makes a very large share of its traffic to external hosts and produced a heavy volume of console errors and DOM mutations after interaction. That is consistent with a script-heavy page, but it is not conclusive evidence by itself. The domain is only a few months old, and archive coverage consists of just a couple of captures, so there is no long operating history to counterbalance the threat listings. Evidence:

• Homepage: access was met with a 403 challenge page titled as a suspected-phishing warning, so no on-site product claims, stat counters or contact details could be examined.
• Reputation sources: ten engines flagged the domain as malicious and three as suspicious; the browser-safety service reported a social-engineering match.
• Domain provenance: registered 2026-05-28 (~0.43 years old).
• Web archive: 2 snapshots between 2026-06-04 and 2026-07-03 (1 year tracked), indicating minimal historical presence.

Regulatory Verification Notes

No legal, terms, privacy or about pages could be assessed, so there is no on-site basis for connecting the domain to a licensed or regulated entity, and no regulatory registration was identified in the available evidence. The real-world operator identity is unverified, and registrant details are incomplete, which amounts to ownership opacity rather than an identity contradiction. This opacity compounds the reputational concern but is not an accusation on its own. No third-party broker-review match was found, so no broker-reputation context exists either way. The domain is registered through a Hong Kong-based registrar with a one-year term, and the site presents a standard domain-validated transport certificate. These are baseline hygiene items that any operator, including a malicious one, can obtain cheaply, and they do not establish legitimacy. Evidence:

• Hosting: served from AS13335 (Cloudflare, Inc., US).
• Transport encryption: TLS certificate issued by YE1 (DV, domain validation only), valid to 2026-12-22.
• Registration: registrar NICENIC International Group Co., Limited; registration expires 2027-05-28.

What to Verify Next

Any prospective interaction should first be treated as unsolicited. If the address was received through a message, advertisement or social post, the sender's claim of affiliation with any XRP or RLUSD-related service should be checked through that issuer's or exchange's officially published channels, reached independently of this domain. No wallet should be connected and no seed phrase, credential or payment detail submitted to this site. Official support and contact channels of any claimed counterparty should be confirmed through an independent route. If the domain belongs to the reader's own organization, the owner should check for compromise and request a review from the flagging vendors after remediation. Evidence:

• Homepage: the interstitial warning shows that the site is currently being actively treated as a suspected phishing destination by the access-control layer.
• Name pattern: the domain imitates crypto-asset ticker naming, so affiliation claims cannot be taken from the name.
• Detection sources: several independent sources flag the domain, so a single false-positive explanation is unlikely.

Summary Verdict

The overall posture is high-risk. Confirmed blacklist listings from multiple independent sources override every neutral or mildly positive technical signal. The domain's youth, minimal history and unverified operator identity reinforce, rather than relieve, that conclusion. The available evidence does not support treating this website as safe for sensitive interaction.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and WAF, and every observed address is a Cloudflare edge address; the origin server was not observable. The edge network carries a clean abuse record, and bot-protection is active. This protection is a mitigating infrastructure factor only. It does not reduce the content-level and reputation-level threat detections, and edge-only visibility prevents independent confirmation of where the content is actually hosted.

Closing Assessment

Read-only observation from an isolated environment is the most that is proportionate. Login, wallet connection, credential entry and any financial transaction should be avoided until the threat listings are cleared and the operator's identity is independently established.