# Phishing sites impersonating XRP PhishDestroy has recorded 136 phishing domains impersonating XRP since 2025-08-16, 9 of them in the last 30 days. The most used registrars are NICENIC and NiceNIC; the most common TLDs are .com and .info. The official XRP domain is xrpl.org: any other site asking for your login or wallet is not XRP. 136Domains, all time 9Last 30 days 80Online at last check 11Confirmed takedowns ## New domains in the last 90 days XRP phishing domains detected per day: 30 from 2026-07-25 to 2026-10-22; peak 3. ## How to tell a fake XRP site Official domain: xrpl.org. Words most often added to the brand in reported domains: ripple, xrpl, airdrop, start, core, brad, black, korea, eligibility, exrp. - Type the address yourself or use a bookmark; phishing links for XRP arrive through ads, search results, direct messages and fake support accounts. - Check the full domain before you sign in: look for extra words, hyphens, a different TLD or look-alike letters. - XRP does not ask you to confirm your password or card details through a link in an email or SMS. Paste a suspicious address into the [Homoglyph Checker](https://phishdestroy.io/developer-tools/homoglyph-checker) or check it against the [DestroyList](https://phishdestroy.io/developer-tools/destroylist-check). ## Latest XRP phishing domains The 50 most recently detected domains impersonating XRP Domain | First detected | Status at last check | Registrar | [xrpl-live.com](https://phishdestroy.io/domain/xrpl-live.com/) | 2026-10-22 | Online | Dynadot | [xrpl-xaman.com](https://phishdestroy.io/domain/xrpl-xaman.com/) | 2026-10-21 | Online | Dynadot | [finance-community.info](https://phishdestroy.io/domain/finance-community.info/) | 2026-10-19 | Online | Global Domain | [xrpl-get.com](https://phishdestroy.io/domain/xrpl-get.com/) | 2026-10-19 | Unknown | NICENIC | [stack-deckcoin.com](https://phishdestroy.io/domain/stack-deckcoin.com/) | 2026-10-19 | Online | PublicDomainRegistry.com | [crate-xrpl.xyz](https://phishdestroy.io/domain/crate-xrpl.xyz/) | 2026-10-13 | Online | NICENIC | [phnixxrp.com](https://phishdestroy.io/domain/phnixxrp.com/) | 2026-10-13 | Online | NICENIC | [gatelab.info](https://phishdestroy.io/domain/gatelab.info/) | 2026-10-09 | Online | NICENIC | [ervnjvnjnvsjknvskdjnvjs.com](https://phishdestroy.io/domain/ervnjvnjnvsjknvskdjnvjs.com/) | 2026-10-07 | Online | NICENIC | [xrpdex.us](https://phishdestroy.io/domain/xrpdex.us/) | 2026-09-19 | Online | NAMECHEAP | [bertswap.org](https://phishdestroy.io/domain/bertswap.org/) | 2026-09-17 | Online | Spaceship | [fig-staking.com](https://phishdestroy.io/domain/fig-staking.com/) | 2026-09-15 | Online | Internet Domain Service BS | [xrp-acess.com](https://phishdestroy.io/domain/xrp-acess.com/) | 2026-09-13 | Online | NICENIC | [xrpl-loyalty.com](https://phishdestroy.io/domain/xrpl-loyalty.com/) | 2026-09-13 | Online | NICENIC | [xpmvault.com](https://phishdestroy.io/domain/xpmvault.com/) | 2026-09-11 | Online | NICENIC | [loyalty-xrpl.com](https://phishdestroy.io/domain/loyalty-xrpl.com/) | 2026-09-11 | Online | NICENIC | [xrpl-invite.com](https://phishdestroy.io/domain/xrpl-invite.com/) | 2026-09-07 | Online | NICENIC | [xmagnetic-xrpl.com](https://phishdestroy.io/domain/xmagnetic-xrpl.com/) | 2026-09-05 | Online | Trustname.com | [vgbvault.com](https://phishdestroy.io/domain/vgbvault.com/) | 2026-09-04 | Online | NICENIC | [xrp-accessing.com](https://phishdestroy.io/domain/xrp-accessing.com/) | 2026-08-31 | Online | NICENIC | [xrp-invitation.com](https://phishdestroy.io/domain/xrp-invitation.com/) | 2026-08-31 | Online | NICENIC | [drop-xrp.xyz](https://phishdestroy.io/domain/drop-xrp.xyz/) | 2026-08-28 | Online | Global Domain | [xrpl-access.com](https://phishdestroy.io/domain/xrpl-access.com/) | 2026-08-24 | Online | NICENIC | [doppler-finances.vercel.app](https://phishdestroy.io/domain/doppler-finances.vercel.app/) | 2026-08-23 | Online | Vercel | [xmagnetic-dex.com](https://phishdestroy.io/domain/xmagnetic-dex.com/) | 2026-08-18 | Online | Trustname.com | [access-xrp.com](https://phishdestroy.io/domain/access-xrp.com/) | 2026-08-12 | Online | NICENIC | [flarehubfxrp.com](https://phishdestroy.io/domain/flarehubfxrp.com/) | 2026-08-10 | Online | PublicDomainRegistry.com | [amlripple.com](https://phishdestroy.io/domain/amlripple.com/) | 2026-08-03 | Online | Trustname.com | [badge-xrp.com](https://phishdestroy.io/domain/badge-xrp.com/) | 2026-08-01 | Online | NICENIC | [swap-xrp.xyz](https://phishdestroy.io/domain/swap-xrp.xyz/) | 2026-07-30 | Online | NameSilo | [xrpl-hub.live](https://phishdestroy.io/domain/xrpl-hub.live/) | 2026-07-20 | Online | NICENIC | [genesis-xrpl.live](https://phishdestroy.io/domain/genesis-xrpl.live/) | 2026-07-20 | Online | NICENIC | [xdnalabs.info](https://phishdestroy.io/domain/xdnalabs.info/) | 2026-07-20 | Online | NICENIC | [strategyxportal.com](https://phishdestroy.io/domain/strategyxportal.com/) | 2026-07-12 | Online | NICENIC | [evernorthlabs.info](https://phishdestroy.io/domain/evernorthlabs.info/) | 2026-07-10 | Online | NICENIC | [uuniteworld.com](https://phishdestroy.io/domain/uuniteworld.com/) | 2026-07-07 | Online | NICENIC | [xrp-alertdesktop.app](https://phishdestroy.io/domain/xrp-alertdesktop.app/) | 2026-06-28 | Online | NICENIC | [xrptagfix.app](https://phishdestroy.io/domain/xrptagfix.app/) | 2026-06-24 | Online | NICENIC | [stovexrp.com](https://phishdestroy.io/domain/stovexrp.com/) | 2026-06-24 | Online | NICENIC | [vagarewards.info](https://phishdestroy.io/domain/vagarewards.info/) | 2026-06-24 | Online | NICENIC | [unite-allocation.com](https://phishdestroy.io/domain/unite-allocation.com/) | 2026-06-21 | Online | NICENIC | [fuzzy-update.live](https://phishdestroy.io/domain/fuzzy-update.live/) | 2026-06-17 | Online | NICENIC | [nodes-xrp.com](https://phishdestroy.io/domain/nodes-xrp.com/) | 2026-06-15 | Online | NICENIC | [app-fxrpfi-flare-8eh83djy83n.firebaseapp.com](https://phishdestroy.io/domain/app-fxrpfi-flare-8eh83djy83n.firebaseapp.com/) | 2026-06-15 | Online | Google Firebase | [xrpfaucet-4qs.pages.dev](https://phishdestroy.io/domain/xrpfaucet-4qs.pages.dev/) | 2026-06-15 | Online | Cloudflare Pages | [ripple-swap.com](https://phishdestroy.io/domain/ripple-swap.com/) | 2026-06-03 | Online | Gname.com | [xrpwalletdoff.com](https://phishdestroy.io/domain/xrpwalletdoff.com/) | 2026-05-15 | Online | Trustname.com | [xrp-apex.com](https://phishdestroy.io/domain/xrp-apex.com/) | 2026-05-15 | Offline | NICENIC | [xrplwalletripple.com](https://phishdestroy.io/domain/xrplwalletripple.com/) | 2026-05-11 | Offline | CNOBIN INFORMATION TECHNOLOGY | [xrpmainnetdapp.com](https://phishdestroy.io/domain/xrpmainnetdapp.com/) | 2026-04-09 | Online | Registrar.eu | [All 136 XRP reports](https://phishdestroy.io/domain/?brand=XRP) ## Where they are registered and hosted ### Registrars - [NICENIC](https://phishdestroy.io/registrar/nicenic/)31 - [NiceNIC](https://phishdestroy.io/registrar/nicenic/)29 - [Web Commerce Communications](https://phishdestroy.io/registrar/webnic/)10 - Regional Network Information Center, dba5 - Cloudflare4 - [Global Domain](https://phishdestroy.io/registrar/global-domain-group/)4 - [PublicDomainRegistry.com](https://phishdestroy.io/registrar/publicdomainregistry-pdr/)4 - [Trustname.com](https://phishdestroy.io/registrar/trustname/)4 ### Top-level domains - [.com](https://phishdestroy.io/tld/com/)63 - [.info](https://phishdestroy.io/tld/info/)13 - [.app](https://phishdestroy.io/tld/app/)10 - [.org](https://phishdestroy.io/tld/org/)10 - [.live](https://phishdestroy.io/tld/live/)9 - [.io](https://phishdestroy.io/tld/io/)6 - [.net](https://phishdestroy.io/tld/net/)6 - [.us](https://phishdestroy.io/tld/us/)3 ### Hosting networks - Cloudflare, Inc.57 - CLOUDFLARENET, US28 - CLOUDFLARENET - Cloudflare, Inc., US13 - IQWeb FZ-LLC5 - CloudFLARENET-EU3 - FASTLY, US2 - ROUTERHOSTING, US2 - Amazon.com, Inc.2 ## Related - [Typosquatting](https://phishdestroy.io/glossary/typosquatting/) - [Homoglyph](https://phishdestroy.io/glossary/homoglyph/) - [Phishing kit](https://phishdestroy.io/glossary/phishing-kit/) - [Homoglyph Checker](https://phishdestroy.io/developer-tools/homoglyph-checker) - [Abuse Report Generator](https://phishdestroy.io/developer-tools/abuse-report-generator) - [If you already used a fake site: emergency guide](https://phishdestroy.io/critical-action) - [All impersonated brands](https://phishdestroy.io/brand/) Data: PhishDestroy domain-report database, built 2026-10-22. Counts cover every reported domain whose stored target brand is XRP; share of all PhishDestroy reports: 0.06%. Canonical: https://phishdestroy.io/brand/xrp/