Phishing sites impersonating XRP

PhishDestroy has recorded 136 phishing domains impersonating XRP since 2025-08-16, 9 of them in the last 30 days. The most used registrars are NICENIC and NiceNIC; the most common TLDs are .com and .info. The official XRP domain is xrpl.org: any other site asking for your login or wallet is not XRP.

136
Domains, all time
9
Last 30 days
80
Online at last check
11
Confirmed takedowns

New domains in the last 90 days

2026-07-25: 02026-07-26: 02026-07-27: 02026-07-28: 02026-07-29: 02026-07-30: 12026-07-31: 02026-08-01: 12026-08-02: 02026-08-03: 12026-08-04: 02026-08-05: 02026-08-06: 02026-08-07: 02026-08-08: 02026-08-09: 02026-08-10: 12026-08-11: 02026-08-12: 12026-08-13: 02026-08-14: 02026-08-15: 02026-08-16: 02026-08-17: 02026-08-18: 12026-08-19: 02026-08-20: 02026-08-21: 02026-08-22: 02026-08-23: 12026-08-24: 12026-08-25: 02026-08-26: 02026-08-27: 02026-08-28: 12026-08-29: 02026-08-30: 02026-08-31: 22026-09-01: 02026-09-02: 02026-09-03: 02026-09-04: 12026-09-05: 12026-09-06: 02026-09-07: 12026-09-08: 02026-09-09: 02026-09-10: 02026-09-11: 22026-09-12: 02026-09-13: 22026-09-14: 02026-09-15: 12026-09-16: 02026-09-17: 12026-09-18: 02026-09-19: 12026-09-20: 02026-09-21: 02026-09-22: 02026-09-23: 02026-09-24: 02026-09-25: 02026-09-26: 02026-09-27: 02026-09-28: 02026-09-29: 02026-09-30: 02026-10-01: 02026-10-02: 02026-10-03: 02026-10-04: 02026-10-05: 02026-10-06: 02026-10-07: 12026-10-08: 02026-10-09: 12026-10-10: 02026-10-11: 02026-10-12: 02026-10-13: 22026-10-14: 02026-10-15: 02026-10-16: 02026-10-17: 02026-10-18: 02026-10-19: 32026-10-20: 02026-10-21: 12026-10-22: 1
XRP phishing domains detected per day: 30 from 2026-07-25 to 2026-10-22; peak 3.

How to tell a fake XRP site

Official domain: xrpl.org.

Words most often added to the brand in reported domains: ripple, xrpl, airdrop, start, core, brad, black, korea, eligibility, exrp.

  • Type the address yourself or use a bookmark; phishing links for XRP arrive through ads, search results, direct messages and fake support accounts.
  • Check the full domain before you sign in: look for extra words, hyphens, a different TLD or look-alike letters.
  • XRP does not ask you to confirm your password or card details through a link in an email or SMS.

Paste a suspicious address into the Homoglyph Checker or check it against the DestroyList.

Latest XRP phishing domains

The 50 most recently detected domains impersonating XRP
DomainFirst detectedStatus at last checkRegistrar
xrpl-live.com2026-10-22OnlineDynadot
xrpl-xaman.com2026-10-21OnlineDynadot
finance-community.info2026-10-19OnlineGlobal Domain
xrpl-get.com2026-10-19UnknownNICENIC
stack-deckcoin.com2026-10-19OnlinePublicDomainRegistry.com
crate-xrpl.xyz2026-10-13OnlineNICENIC
phnixxrp.com2026-10-13OnlineNICENIC
gatelab.info2026-10-09OnlineNICENIC
ervnjvnjnvsjknvskdjnvjs.com2026-10-07OnlineNICENIC
xrpdex.us2026-09-19OnlineNAMECHEAP
bertswap.org2026-09-17OnlineSpaceship
fig-staking.com2026-09-15OnlineInternet Domain Service BS
xrp-acess.com2026-09-13OnlineNICENIC
xrpl-loyalty.com2026-09-13OnlineNICENIC
xpmvault.com2026-09-11OnlineNICENIC
loyalty-xrpl.com2026-09-11OnlineNICENIC
xrpl-invite.com2026-09-07OnlineNICENIC
xmagnetic-xrpl.com2026-09-05OnlineTrustname.com
vgbvault.com2026-09-04OnlineNICENIC
xrp-accessing.com2026-08-31OnlineNICENIC
xrp-invitation.com2026-08-31OnlineNICENIC
drop-xrp.xyz2026-08-28OnlineGlobal Domain
xrpl-access.com2026-08-24OnlineNICENIC
doppler-finances.vercel.app2026-08-23OnlineVercel
xmagnetic-dex.com2026-08-18OnlineTrustname.com
access-xrp.com2026-08-12OnlineNICENIC
flarehubfxrp.com2026-08-10OnlinePublicDomainRegistry.com
amlripple.com2026-08-03OnlineTrustname.com
badge-xrp.com2026-08-01OnlineNICENIC
swap-xrp.xyz2026-07-30OnlineNameSilo
xrpl-hub.live2026-07-20OnlineNICENIC
genesis-xrpl.live2026-07-20OnlineNICENIC
xdnalabs.info2026-07-20OnlineNICENIC
strategyxportal.com2026-07-12OnlineNICENIC
evernorthlabs.info2026-07-10OnlineNICENIC
uuniteworld.com2026-07-07OnlineNICENIC
xrp-alertdesktop.app2026-06-28OnlineNICENIC
xrptagfix.app2026-06-24OnlineNICENIC
stovexrp.com2026-06-24OnlineNICENIC
vagarewards.info2026-06-24OnlineNICENIC
unite-allocation.com2026-06-21OnlineNICENIC
fuzzy-update.live2026-06-17OnlineNICENIC
nodes-xrp.com2026-06-15OnlineNICENIC
app-fxrpfi-flare-8eh83djy83n.firebaseapp.com2026-06-15OnlineGoogle Firebase
xrpfaucet-4qs.pages.dev2026-06-15OnlineCloudflare Pages
ripple-swap.com2026-06-03OnlineGname.com
xrpwalletdoff.com2026-05-15OnlineTrustname.com
xrp-apex.com2026-05-15OfflineNICENIC
xrplwalletripple.com2026-05-11OfflineCNOBIN INFORMATION TECHNOLOGY
xrpmainnetdapp.com2026-04-09OnlineRegistrar.eu

All 136 XRP reports

Where they are registered and hosted

Registrars

  1. NICENIC31
  2. NiceNIC29
  3. Web Commerce Communications10
  4. Regional Network Information Center, dba5
  5. Cloudflare4
  6. Global Domain4
  7. PublicDomainRegistry.com4
  8. Trustname.com4

Top-level domains

  1. .com63
  2. .info13
  3. .app10
  4. .org10
  5. .live9
  6. .io6
  7. .net6
  8. .us3

Hosting networks

  1. Cloudflare, Inc.57
  2. CLOUDFLARENET, US28
  3. CLOUDFLARENET - Cloudflare, Inc., US13
  4. IQWeb FZ-LLC5
  5. CloudFLARENET-EU3
  6. FASTLY, US2
  7. ROUTERHOSTING, US2
  8. Amazon.com, Inc.2

Related

Data: PhishDestroy domain-report database, built 2026-10-22. Counts cover every reported domain whose stored target brand is XRP; share of all PhishDestroy reports: 0.06%.