XRP Ledger Address

Detects XRP Ledger classic addresses: base58-encoded, starting with the character "r", 25-35 characters long, encoding a 21-byte buffer (1-byte prefix value 0 + 160-bit account ID) with a 4-byte checksum. The XRP base58 dictionary excludes 0, capital O, capital I and lowercase l — the same 58-character set as standard base58, so a standard base58 class matches the charset. A single leading letter is weak structure, so detection is context-gated. Length/charset/prefix verified against xrpl.org address docs.

Type: regex
Engine: universal
Confidence: medium
Confidence justification: Gated 75, not high: a single leading "r" plus a base58 run is weak structure with no regex-expressible checksum, so it collides with other "r..."-leading base58 tokens. Precision comes from the mandatory cryptocurrency/wallet domain-context gate plus the noise exclusion.
Jurisdictions: global
Regulations: FATF Recommendations, AML/CTF Act (Cth)
Frameworks: ISO 27001, ISO 27701, SOC 2
Data categories: financial
Scope: narrow
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Compatible, Netskope: Compatible

Pattern

\br[1-9A-HJ-NP-Za-km-z]{24,34}\b

Corroborative evidence keywords

identifier, number, ID, transaction, transfer, payment, deposit, withdrawal, debit, credit, data record, database record, record set, data extract, data export, database table, spreadsheet, data registry, registry entry, master data (+14 more)

Proximity: 300 characters

Should match

rDTXLQ7ZKZVKz33zJbHjgVShjsBnqMBhmN — Classic address from the xrpl.org base58 encoding example (34 chars)
rHb9CJAWyB4rj91VRWn96DkukG4bwdtyTh — Genesis account address (documented, 34 chars)
rrrrrrrrrrrrrrrrrrrrrhoLvTp — ACCOUNT_ZERO special address (documented, 27 chars — near lower bound)

Should not match

zDTXLQ7ZKZVKz33zJbHjgVShjsBnqMBhmN — Wrong prefix (does not start with r)
r123456789 — Too short (below the 25-char minimum)
r1111111111111111111111111111111111111 — Too long (r + 37 = 38, above the 35-char maximum)
rDTXLQ7ZKZVKz33-zJbHjgVShjsBnqMBhmN — Hyphen breaks the run so no contiguous 25-35 char body exists — rejected
xrp wallet address example placeholder — Template/placeholder context should be excluded even when domain anchor words are present

Known false positives

A single leading "r" followed by a base58 run collides with other "r..."-prefixed base58 tokens and identifiers; the XRP 4-byte checksum cannot be validated in a Purview-safe regex. Mitigation: The tier is AND-gated by cryptocurrency/wallet domain context (crypto-wallet-context) within the proximity window plus a template/sample noise NOT-group; held at 75.

References

Collections

Cryptocurrency Wallet Addresses