xrpl-app[.]live

The domain xrpl-app.live was created on July 17, 2026 and is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. It is delegated to the Cloudflare nameservers agustin.ns.cloudflare.com and zoe.ns.cloudflare.com and resolves to the IP address 188.114.97.3. VirusTotal has recorded scans from 91 antivirus and security vendors; at the time of the scan none flagged the domain, but the absence of detections does not constitute proof of safety. Independent reputation services have taken action: the domain is listed on one security blocklist and is actively blocked by PhishDestroy, indicating that external monitoring systems have classified it as malicious. No additional intelligence such as page title, brand targeting, or detailed content analysis is presently available, so the precise nature of the phishing lure remains unspecified. The rapid appearance of the domain—registered only three days before the report date—suggests a short‑lived infrastructure typical of opportunistic phishing campaigns. Defenders should prioritize immediate mitigation by adding xrpl-app.live to DNS blocklists, proxy filters, and endpoint firewalls. Because the host IP belongs to a Cloudflare edge node, blocking the IP globally may impact legitimate services; URL‑based filtering is therefore recommended. Continuous monitoring of the IP address for anomalous traffic patterns and periodic re‑query of VirusTotal and other sandbox environments is advised to capture any later detections. Security teams should also consider reviewing other domains registered by the same registrar within a similar timeframe, as attackers often reuse registration services for multiple campaign assets. Users should be cautioned to scrutinize unsolicited messages that reference cryptocurrency or related services, even though the exact thematic focus of this campaign has not been publicly disclosed.