xrpswap[.]org

This domain, xrpswap.org, poses as a decentralized exchange (DEX) on the XRP Ledger but is a confirmed brand impersonation targeting Ledger users. The site presents itself as a platform for swapping XRP, RLUSD, and XRPL tokens, using the title 'XRPSwap — #1 DEX on XRP Ledger | Swap XRP, RLUSD & XRPL Tokens.' In reality, it functions as a crypto drainer, designed to trick users into connecting their wallets and authorizing malicious transactions that siphon funds. The threat is classified as high-risk due to its deceptive branding and active exploitation of trust in legitimate hardware wallet services. Analysis indicates the domain was registered on April 28, 2026, through GoDaddy.com, LLC, a registrar frequently abused for phishing infrastructure. Detection metrics reveal 14 out of 95 security vendors on VirusTotal flag the domain as malicious, with four security blocklists—including MetaMask, PhishDestroy, SEAL, and InversionDNS—actively blocking access. The site resolved to the IP address 186.2.175.35 and used a Let’s Encrypt SSL certificate, a common tactic to feign legitimacy. Google Safe Browsing further categorizes the domain under 'SOCIAL_ENGINEERING,' confirming its intent to manipulate users through deceptive practices. The Gridinsoft trust score of 0/100 underscores its lack of credibility. If a user visited xrpswap.org and connected a wallet or interacted with the site, immediate action is required. First, revoke any suspicious token approvals or smart contract interactions using a trusted blockchain explorer or wallet management tool. Next, transfer all assets to a new, secure wallet address and monitor the compromised wallet for unauthorized transactions. Users should also scan their devices for malware, as phishing sites may deploy additional payloads. Finally, report the domain to relevant security communities and blocklists to prevent further exploitation. No funds or sensitive information should be shared with the site under any circumstances.