Honeypot XRPL

Live ledger analysis and threat dashboard for the XRPL community

Establishing live connection …
– Network
– As of
– Findings malicious (live)
– Findings suspect (live)
– Transactions (live)

Live threat radar for the XRP Ledger

Every validated ledger block is analyzed in real time — findings and clusters, live from the public ledger.

0malicious 0suspect 0checked txs

Top exchanges receiving drained funds

Where the most drained funds land — the exchanges themselves are not the perpetrators.

Only the 50 largest edges by volume per cluster are kept by the state (lower bound); 30 days reflects the fraud retention of the live state, not a complete wallet history; exchange detection = registry ∪ verified well-known names.

Top drainer accounts by received funds

The drainer role is a heuristic from in/out degree and money flow — a signal, not a proven verdict.

Only the 50 largest edges by volume per cluster are kept by the state (lower bound); role fields are capped at 300 entries per cluster; accounts of the exchange union rank in the left box and are excluded here; 30 days reflects the fraud retention of the live state, not a complete wallet history.

Live Block Feed

Validated ledger blocks in real time – analysis in the browser with the same engine as on the server
0 ledgers 0 checked txs 0 malicious 0 suspect 0 info
Data source

Archive mode: persisted block window (24 h / 3 d / 7 d) from the server — the 30 d / 90 d windows show the persisted fraud state instead. Also available when no live feed is connected.

    Waiting for the first validated ledger …

    Analysis Log

    No rule hits in the observation window yet.

    Fund addresses are exclusively actor addresses visible in the public ledger and are shown in full as soon as the bait-hash allowlist is loaded. Bait accounts never appear in the log – the server sanitizes them to labels and the client blocks them via the hash deny-list.

    Network load patterns

    Ledger-level anomalies (load spikes, close gaps, finding bursts) with UTC timestamps

      Validator health

      Agreement scores of the public UNL validators, refreshed every minute

          Data: xrpscan.com (CC BY-NC-SA 4.0)

          Activity Graph

          Source Drainer Collector Relay Unknown Cluster Payment Escrow Check/Channel DEX/AMM NFT Admin Fraud edge Other Malicious Suspect Info

          Roles (source, drainer, collector, relay) are heuristics based on in/out degree and money flow – not proof of guilt.

          Nodes are actors visible in the public ledger from the live analysis – addresses are shown in full as soon as the bait-hash allowlist is loaded (bait addresses always remain hidden via the hash deny-list). Clicking a cluster card or a cluster bubble opens the cluster detail view.