# PhishDestroy domain threat record: xrpl-live.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/xrpl-live.com/ Machine-readable companion: https://phishdestroy.io/domain/xrpl-live.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-22 13:01:39 UTC - Last availability or vendor check: 2026-10-22 13:01:39 UTC - Stored record updated: 2026-10-22 16:30:28 UTC - VirusTotal detections in the stored snapshot: 0/92 - Independent public blocklist matches in the stored snapshot: 2 - Matching public blocklists: MetaMask, SEAL - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: XRP - Phishing kit: Airdrop Scam ## Stored infrastructure - Observed IP address: 104.21.26.43 - Registrar in stored WHOIS data: Dynadot Inc - Last stored HTTP status: 200 - Registration date (registry RDAP, xrpl-live.com): 2026-10-21 18:28:41 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a163b2-4309-773a-b06b-9fec8cbc7140/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/xrpl-live.com - Certificate Transparency search: https://crt.sh/?q=%25.xrpl-live.com - Web Archive lookup: https://web.archive.org/web/*/https://xrpl-live.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy’s intake system flagged xrpl-live.com because a fresh URLScan capture labeled the page malicious and an AI model identified it as a phishing site impersonating Xaman’s “XAM Airdrop”. The recorded page title reads “XAM Airdrop: Check If Your Allocation Is Waiting | Xaman”, matching the impersonation claim. The domain was first seen by PhishDestroy on 2026-10-22, one day after registration. How the scam works Scammers publish a page that pretends to be an official Xaman airdrop, promising a token allocation and urging visitors to connect their crypto wallet. When a victim authorizes the connection, the malicious site can read wallet balances, request token transfers, or capture private keys, enabling fund theft. Evidence A URLScan capture on 2026-10-22 returned a malicious verdict with a 100 score and phishing tags, which contributed to the multi‑source intake flag. VirusTotal scanned the domain on the same day and reported zero detections out of 92 engines. Google Safe Browsing did not flag the site, while external blocklists MetaMask and SEAL listed it, and PhishDestroy’s internal list marked it as malicious. OTX recorded four pulses referencing the domain as of 2026-10-22, and Cloudflare Radar also returned a malicious phishing verdict. Infrastructure The domain was registered on 2026-10-21 through Dynadot Inc. Hosting records show the site resolved to Cloudflare IPs 104.21.26.43 and 172.67.135.94, with the network identified as Cloudflare, Inc. in Canada. TLS was provided by Let’s Encrypt, valid from 2026-10-21 to 2027-01-19, covering both the apex and wildcard of xrpl-live.com. What to do Do not connect any crypto wallet to xrpl-live.com and avoid entering seed phrases or private keys. If a wallet was connected, immediately revoke any approvals and consider moving assets to a new, secure wallet. Defenders should block the domain xrpl-live.com at the network perimeter, monitor DNS queries for the domain, and review logs for any wallet‑connect attempts. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a163b2-4309-773a-b06b-9fec8cbc7140/ Cloudflare Radar report: https://radar.cloudflare.com/scan/58e804aa-0caf-4fdc-8781-0951576819b8 URLQuery report: https://urlquery.net/report/756bbed6-7e52-48e9-9cee-17c79ec9b599 Stored capture screenshot: https://i.ibb.co/vCyFfLqh/50bd44011c44.png Cloudflare Radar screenshot (2026-10-22T13:36:42Z): https://screenshots.phishdestroy.io/cf/58e804aa-0caf-4fdc-8781-0951576819b8.png URLScan screenshot (2026-10-21T18:34:06Z): https://screenshots.phishdestroy.io/us/01a15fbd-cfbb-714e-9168-96f5caa797cc.png URLScan capture report: https://urlscan.io/result/01a15fbd-cfbb-714e-9168-96f5caa797cc/ URLScan screenshot (2026-10-21T18:34:15Z): https://screenshots.phishdestroy.io/us/01a15fbd-cd28-747f-ba66-08a3b848c993.png URLScan capture report: https://urlscan.io/result/01a15fbd-cd28-747f-ba66-08a3b848c993/ URLScan screenshot (2026-10-22T11:22:59Z): https://screenshots.phishdestroy.io/us/01a16359-793e-7059-8a60-63ac90199aed.png URLScan capture report: https://urlscan.io/result/01a16359-793e-7059-8a60-63ac90199aed/ URLScan screenshot (2026-10-22T13:06:04Z): https://screenshots.phishdestroy.io/us/01a163b7-dc9d-75fc-b2e4-3628de88881c.png URLScan capture report: https://urlscan.io/result/01a163b7-dc9d-75fc-b2e4-3628de88881c/ VirusTotal report: https://www.virustotal.com/gui/domain/xrpl-live.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=xrpl-live.com Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-22 13:40:49 UTC ## Stored page captures - Primary capture: https://i.ibb.co/vCyFfLqh/50bd44011c44.png Captured: 2026-10-22 13:01:39 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a163b2-4309-773a-b06b-9fec8cbc7140.png Captured: 2026-10-22 13:01:39 UTC Source report: https://urlscan.io/result/01a163b2-4309-773a-b06b-9fec8cbc7140/ - URLScan capture 2: https://urlscan.io/screenshots/01a16359-793e-7059-8a60-63ac90199aed.png Captured: 2026-10-22 12:57:49 UTC Source report: https://urlscan.io/result/01a163b2-4309-773a-b06b-9fec8cbc7140/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/58e804aa-0caf-4fdc-8781-0951576819b8.png Captured: 2026-10-22 13:36:42 UTC Source report: https://radar.cloudflare.com/scan/58e804aa-0caf-4fdc-8781-0951576819b8 SHA-256: 30b29f24855a3d7a0bf237a6984ee846356c01bac4fe958496fd3e418363f2ee - URLScan · 2026-10-21: https://screenshots.phishdestroy.io/us/01a15fbd-cfbb-714e-9168-96f5caa797cc.png Captured: 2026-10-21 18:34:06 UTC Source report: https://urlscan.io/result/01a15fbd-cfbb-714e-9168-96f5caa797cc/ SHA-256: bb482e84303fb0255b74dc2bedf488afb71782d9bbd7ca8314f48241b4084b68 - URLScan · 2026-10-21: https://screenshots.phishdestroy.io/us/01a15fbd-cd28-747f-ba66-08a3b848c993.png Captured: 2026-10-21 18:34:15 UTC Source report: https://urlscan.io/result/01a15fbd-cd28-747f-ba66-08a3b848c993/ SHA-256: 05c4c8c5e014d32b16d4cc4f15f53cb4d68040db5bcc22124f51c6132791acba - URLScan · 2026-10-22: https://screenshots.phishdestroy.io/us/01a16359-793e-7059-8a60-63ac90199aed.png Captured: 2026-10-22 11:22:59 UTC Source report: https://urlscan.io/result/01a16359-793e-7059-8a60-63ac90199aed/ SHA-256: e5c46e10ac7ef3a77ff23256bf32dd3638ba2526297a3f71162b9e6561c93411 - URLScan · 2026-10-22: https://screenshots.phishdestroy.io/us/01a163b7-dc9d-75fc-b2e4-3628de88881c.png Captured: 2026-10-22 13:06:04 UTC Source report: https://urlscan.io/result/01a163b7-dc9d-75fc-b2e4-3628de88881c/ SHA-256: e9c611bd45933b19f4e583b21dce4954d6f62dab98792bc5f69dc4f42cc466ca ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-22T13:03:29Z", "uuid": "01a163b2-4309-773a-b06b-9fec8cbc7140", "scanned_at": "2026-10-22T12:59:58Z", "final_url": "https://xrpl-live.com/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://xrpl-live.com/", "from": "http://xrpl-live.com/", "status": 307 } ], "ip": "172.67.135.94", "domains": [ "xrpl-scaner.com", "crossmark.io", "play-lh.googleusercontent.com", "pbs.twimg.com", "api.ipify.org" ], "ips": [ "172.67.162.171", "76.76.21.21", "192.178.183.119", "146.75.120.159", "104.26.13.205", "172.67.135.94" ], "asns": [ "13335", "16509", "15169", "54113" ], "countries": [ "US", "DE" ], "link_domains": [ "help.xaman.app" ], "doc_hash": "62c2f7efd27450e17855c2a383d0298ea30b6fe89d79de0080e86e8588114568", "script_hashes": [ "c5d140c542dd219f6855ec7784b24f4174e60dc2b408a70fac7ab7280b8ef696" ], "globals": [ "_0x5cb3", "_0x8696", "_0x4f32fa", "__ledgerLogsListen", "XRPLWalletConnect", "savepage_ShadowLoader", "__xamanSeedP" ], "tls": { "san": [ "*.xrpl-live.com", "xrpl-live.com" ], "cipher": "AES_128_GCM", "issuer": "YE2", "subject": "xrpl-live.com", "protocol": "QUIC", "valid_to": "2027-01-19T17:33:17Z", "valid_from": "2026-10-21T17:33:18Z" }, "domain_age_days": 0, "apex_age_days": 0, "tls_age_days": 0, "tls_valid_days": 89, "requests": 14, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 99, "malicious": true }, "overall": { "tags": [ "phishing" ], "score": 100, "brands": [ "genericcrypto" ], "malicious": true, "categories": [ "phishing" ] }, "urlscan": { "tags": [ "phishing" ], "score": 100, "brands": [ "Generic Crypto" ], "malicious": true, "categories": [ "phishing" ] } }, "headers": { "server": "cloudflare", "content-type": "text/html", "strict-transport-security": "max-age=63072000; includeSubDomains; preload", "content-security-policy": "frame-ancestors http: https:", "x-content-type-options": "nosniff" } }, "cf": { "v": 1, "fetched_at": "2026-10-22T13:40:07Z", "uuid": "58e804aa-0caf-4fdc-8781-0951576819b8", "scanned_at": "2026-10-22T13:36:42Z", "final_url": "https://xrpl-live.com/", "status": 200, "history": [ { "url": "https://xrpl-live.com/", "status": 200 } ], "dom_hash": "1ad1b3bbbcc05819b7118ca2bab7aa73a26f0b1511b6d51d648eb3aeef33c8d5", "doc_hash": "794e6cbe9e9b5212af6ab37c978c026d9daeb0189a4c752eb30246498538a766", "phishing_v2": [ "phishing" ], "url_risks": [ "Phishing" ], "domain_risks": [ "Phishing", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "xrpl-live.com", "type": "A", "value": "104.21.26.43" }, { "name": "xrpl-live.com", "type": "A", "value": "172.67.135.94" }, { "name": "xrpl-live.com", "type": "AAAA", "value": "2606:4700:3037::6815:1a2b" }, { "name": "xrpl-live.com", "type": "AAAA", "value": "2606:4700:3034::ac43:875e" } ], "dnssec_valid": false, "ip": "104.21.26.43", "verdict": { "tags": [ "phishing" ], "malicious": true, "categories": [ "phishing" ] }, "whois": { "registrar": "Dynadot Inc", "created": "2026-10-21T18:28:41Z", "updated": "2026-10-21T18:29:33Z", "expires": "2027-10-21T18:28:41Z", "nameservers": [ "edna.ns.cloudflare.com", "roman.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-22T13:36:26Z", "analysis_at": "2026-10-22T10:40:11Z", "stats": { "timeout": 0, "harmless": 55, "malicious": 0, "suspicious": 0, "undetected": 37 }, "reputation": 0, "tags": [ "dga" ], "registrar": "Dynadot Inc", "created": "2026-10-21T18:28:41Z", "expires": "2027-10-21T18:28:41Z", "updated": "2026-10-21T18:29:33Z", "first_seen": "2026-10-21T18:40:43Z", "dns": [ { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "edna.ns.cloudflare.com" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3034::ac43:875e" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3037::6815:1a2b" }, { "ttl": 21600, "type": "NS", "value": "edna.ns.cloudflare.com" }, { "ttl": 21600, "type": "NS", "value": "roman.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "172.67.135.94" }, { "ttl": 300, "type": "A", "value": "104.21.26.43" } ], "dns_at": "2026-10-22T10:48:32Z", "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c", "cert": { "san": [ "*.xrpl-live.com", "xrpl-live.com" ], "issuer": "Let's Encrypt / YE2", "serial": "64b7d922091b15126061bfdade062c976b4", "sha256": "39f234874088b56ec44afd6a55789942ee651ec253ab3d05f078955c64835fa5", "subject": "xrpl-live.com", "valid_to": "2027-01-19T17:33:17Z", "valid_from": "2026-10-21T17:33:18Z" }, "whois": { "registrar": "Dynadot Inc", "registrar_iana_id": "472", "registrar_url": "http://www.dynadot.com", "created": "2026-10-21T18:28:41Z", "updated": "2026-10-21T18:29:33Z", "expires": "2027-10-21T18:28:41Z", "status": [ "clientTransferProhibited" ], "nameservers": [ "edna.ns.cloudflare.com", "roman.ns.cloudflare.com" ], "dnssec": "unsigned" }, "rdap": { "status": [ "client transfer prohibited" ], "events": { "expiration": "2027-10-21T18:28:41Z", "last changed": "2026-10-21T18:29:33Z", "registration": "2026-10-21T18:28:41Z", "last update of RDAP database": "2026-10-21T18:40:20Z" } } }, "webcheck": { "v": 1, "fetched_at": "2026-10-22T13:40:28Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "xrpl-live.com" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "archives": { "last": "2026-10-22T13:01:13Z", "first": "2026-10-22T13:01:13Z", "changes": 0, "days_archived": 1, "avg_page_bytes": 131927 }, "social_tags": { "title": "XAM Airdrop: Check If Your Allocation Is Waiting | Xaman", "themeColor": "#ffffff", "description": "250,000,000 XAM is being distributed to early Xaman users. Allocations are already reserved on-chain. Connect your wallet to see if yours is waiting before the claim window closes." }, "trackers": { "requests": 7, "trackers": [ { "name": "Google User Content", "company": "Google", "country": "US", "category": "Hosting", "requests": 1 }, { "name": "ipify", "company": "ipify", "category": "Misc", "requests": 1 }, { "name": "X Corp.", "company": "X Corp.", "country": "US", "category": "Social Media", "requests": 1 } ] }, "mixed_content": { "third_party_scripts": 0 }, "status": { "up": true, "code": 200, "timings": { "dns": 2, "tls": 35, "wait": 100, "connect": 8, "download": 38 }, "response_ms": 183 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "carbon": { "bytes": 198506, "co2_grams": 0.0073, "cleaner_than": 7 }, "dns_server": { "ns": [ { "ip": "108.162.195.103", "host": "roman.ns.cloudflare.com" }, { "ip": "172.64.32.109", "host": "edna.ns.cloudflare.com" } ], "zone": "xrpl-live.com" }, "location": { "ip": "2606:4700:3037::6815:1a2b", "asn": "13335", "org": "Cloudflare, Inc.", "city": "Toronto", "country": "CA" }, "ssl": { "issuer": "Let's Encrypt / YE2", "subject": "xrpl-live.com" }, "dns": { "A": [ "104.21.26.43", "172.67.135.94" ], "NS": [ "roman.ns.cloudflare.com", "edna.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"edna.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418116334, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}", "AAAA": [ "2606:4700:3034::ac43:875e", "2606:4700:3037::6815:1a2b" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "header": "max-age=63072000; includeSubDomains; preload", "message": "Site is compatible with the HSTS preload list!", "compatible": true }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": "1; mode=block", "permissionsPolicy": false, "xContentTypeOptions": "nosniff", "contentSecurityPolicy": "frame-ancestors http: https:", "strictTransportPolicy": "max-age=63072000; includeSubDomains; preload", "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "firewall": { "waf": "Cloudflare", "has_waf": true }, "get_ip": { "ip": "2606:4700:3037::6815:1a2b", "family": 6 }, "redirects": { "chain": [ "https://xrpl-live.com" ] }, "tech_stack": { "technologies": [ "HSTS", "Cloudflare", "HTTP/3" ] }, "linked_pages": { "external": [ "https://help.xaman.app/app" ], "external_count": 1, "internal_count": 1 }, "whois": { "registrar": "Dynadot Inc", "created": "2026-10-21T18:28:41Z", "updated": "2026-10-21T18:29:33Z", "expires": "2027-10-21T18:28:41Z", "status": [ "clientTransferProhibited https://icann.org/epp" ], "nameservers": [ "edna.ns.cloudflare.com", "roman.ns.cloudflare.com" ] }, "headers": { "headers": { "server": "cloudflare", "content-type": "text/html", "strict-transport-security": "max-age=63072000; includeSubDomains; preload", "content-security-policy": "frame-ancestors http: https:", "x-content-type-options": "nosniff" } } } } ```