xrpvault[.]network

This domain, xrpvault.network, is identified as part of an investment scam infrastructure targeting users with a fraudulent XRP staking scheme. Registered on February 21, 2026, through NiceNIC International Group Co., Limited, the domain resolves to the IP address 216.198.79.65, hosted on Amazon.com, Inc. (AS16509) in the United States. Analysis of its infrastructure reveals the use of Cloudflare nameservers (zara.ns.cloudflare.com and damien.ns.cloudflare.com) and deployment on Vercel, with HSTS enabled. The SSL certificate is classified as R13, and the HTTP status code returned is 451, indicating unavailability due to legal or policy restrictions.

The page title, 'Flare — XRP Staking,' suggests an attempt to impersonate or leverage the Flare Network brand, a known blockchain platform, to deceive victims into engaging with the scam. Google Safe Browsing has flagged the domain for social engineering, aligning with its classification as an investment scam. Detection by security vendors is notable, with 10 out of 93 vendors on VirusTotal marking the domain as malicious. Additionally, the domain appears on four security blocklists and is actively blocked by PhishDestroy, Polkadot, Enkrypt, and Codeesura.

As of July 23, 2026, the domain is offline, though its prior activity and infrastructure remain a concern. Defenders should prioritize monitoring for re-emergence or similar domains leveraging the same hosting, registrar, or nameserver patterns. Organizations are advised to update blocklists with this domain and investigate any historical connections to internal networks or user reports. Given the use of Cloudflare and Vercel, further scrutiny of domains sharing these infrastructure components is recommended to identify related threats.