phase2-xrpl.live
Category: Phishing
To use full-featured product, you have to purchase a license for Combo Cleaner. Limited seven days free trial available. Combo Cleaner is owned and operated by RCS LT, the parent company of PCRisk.com.
Description of phase2-xrpl.live
phase2-xrpl.live appears to present itself as a cryptocurrency-related landing page tied to the XRP Ledger ecosystem. The page branding, title, and visible content reference Xaman, a self-custody wallet, and promote an "$XRPL Rewards Allocation Proposal" with a wallet-connection call to action. Based on the screenshot and metadata, the site appears designed to encourage visitors to connect a crypto wallet in order to participate in a voting or rewards-related activity.
The domain itself does not match the branded service shown on the page, and it references a separate external domain, xaman-voting.com, alongside common mobile app and font providers. Multiple web-classification sources categorize the site in phishing or fraud-related categories, while another classifies it under financial services. Taken together, the site appears to be a crypto-themed campaign page that may be attempting to leverage recognizable wallet branding to attract XRP/XRPL users.
Safety Assessment for phase2-xrpl.live
Several risk indicators are present at the time of this scan. The domain was flagged by 4 out of 91 security engines, with multiple detections describing the site as phishing-related, and multiple web-classification providers also categorized it as phishing or fraud. The page content appears to imitate or closely reference the Xaman wallet brand while using a different domain name, and the prominent "Connect Wallet" / voting flow is a common pattern seen on crypto-drain or credential-harvesting pages.
At the same time, some checks were clean: the malware scan did not identify flagged files, and major threat-database checks for known malware and phishing URLs did not report listings at the time of this scan. However, the domain is only 1 day old, has no established traffic ranking, and uses branding that appears inconsistent with the domain name shown to visitors. In cryptocurrency contexts, a very new domain combined with wallet-connection prompts and brand-referencing presentation materially increases risk.
Based on these findings, this website may pose potential risks to visitors.
Technical Description
The site uses a valid SSL certificate issued by a mainstream certificate authority, and traffic is routed through Cloudflare infrastructure with hosting resolved to a Cloudflare IP in Canada. The domain uses Cloudflare nameservers and appears to sit behind Cloudflare's reverse-proxy service, which can obscure the origin server. DNSSEC is unsigned, which is not uncommon but does mean DNS responses do not benefit from DNSSEC validation.
From a security posture standpoint, the main concerns are not certificate validity or hosting quality but the surrounding trust signals: a very recently registered domain, phishing-related detections from multiple security engines, and branding that appears inconsistent with the domain itself. No malicious files or iframes were identified in the provided scan data, but that does not rule out social-engineering or wallet-connection abuse.
Share your experience with this website. Was it safe? Did you encounter any issues?