aliensonxrpl[.]pages[.]dev

This domain is flagged as an active phishing infrastructure targeting users of the XRP Ledger (XRPL) ecosystem. Analysis indicates the site employs generic phishing tactics to harvest sensitive information, likely including wallet credentials or private keys under the guise of an "Aliens On XRPL" project. The risk level remains under investigation, but the domain exhibits characteristics consistent with credential theft operations. Infrastructure analysis reveals the domain aliensonxrpl.pages.dev resolves to IP address 172.66.45.4, hosted on Cloudflare infrastructure in California. It was registered through Cloudflare Pages on March 25, 2026, with an SSL certificate issued by Google Trust Services (WE1). VirusTotal reports 0 detections out of 95 security engines, suggesting the domain has not yet been widely flagged. The domain appears on one security blocklist and is currently blocked by at least one threat intelligence feed. The page title, "Aliens On XRPL," suggests an attempt to lure users with themed content related to the XRP Ledger. Mitigation steps should focus on preventing user interaction with the domain. Network-level blocking of 172.66.45.4 and the domain itself is recommended for organizations. Users should be educated to recognize phishing indicators, such as unexpected XRPL-themed projects hosted on non-official domains (e.g., pages.dev subdomains). Wallet software and browser extensions should be configured to warn against interactions with newly registered or low-reputation domains. Monitoring for further detections on VirusTotal or additional blocklist appearances may provide updated risk assessments.