wrappedtx[.]com

This domain, wrappedtx.com, operates as a fraudulent cryptocurrency distribution platform targeting users of the XRP Ledger (XRPL). The site presents itself as a legitimate "wTX Allocation Live" portal, claiming to offer wrapped TX token claims. Analysis indicates this is a high-confidence phishing operation designed to harvest wallet credentials, private keys, or seed phrases under the pretense of token distribution. The page title explicitly states "Claim Wrapped TX on XRPL," a tactic commonly employed to exploit users seeking airdrops or token allocations from emerging projects.

Technical indicators strongly support the malicious classification. The domain is flagged by 13 out of 95 security vendors on VirusTotal, including multiple blockchain-specific threat detection engines. Infrastructure analysis reveals the domain was registered on May 20, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with abusive registrations. The site appears on four independent security blocklists and resolves to the IP address 172.67.212.173, hosted behind Cloudflare’s network. While the presence of HSTS and a Let’s Encrypt SSL certificate may lend a superficial appearance of legitimacy, these are commonly exploited by threat actors to evade basic scrutiny.

Users who have interacted with wrappedtx.com should assume compromise of any credentials or sensitive data entered. Immediate steps include revoking access to connected wallets, generating new key pairs, and monitoring associated accounts for unauthorized transactions. All interactions with the domain should be documented for potential incident response. Given the domain’s active status and high-risk classification, network-level blocking is recommended for organizations to prevent further exposure.