xrpsw[.]app

Analysis of xrpsw.app shows a newly registered domain (creation date 2026-04-18) hosted behind Cloudflare’s infrastructure. The authoritative nameservers are julian.ns.cloudflare.com and lilyana.ns.cloudflare.com, and the domain resolves to IP 172.67.140.241, which is owned by Cloudflare, Inc. in Canada. TLS termination is provided by a certificate issued by Google Trust Services under the WE1 identifier, and the site serves HTTP 200 responses with HSTS enabled, HTTP/3 support, and front‑end assets detected as Vercel and Google Analytics. The page title returned by the server is “XRPSwap”, matching the listed scam type of a crypto drainer. Reputation services rate the site extremely poorly (Gridinsoft 0/100) and one security vendor among ninety‑four on VirusTotal flagged the domain. PhishDestroy has already added it to its blocklist, and it appears on a single external blocklist. The domain is currently active and classified as high‑risk. At present, no additional infrastructure such as command‑and‑control servers or payload delivery mechanisms has been observed. Defenders should prioritize blocking the domain and its resolving IP, enforce outbound filtering for connections to Cloudflare‑hosted IPs associated with this indicator, and incorporate the observed TLS fingerprint and HTTP header set into intrusion‑detection signatures. Continuous monitoring for new IPs or certificate changes is recommended, as the attacker may pivot to alternative Cloudflare edge nodes.