app[.]xrpl-gov[.]xyz

On August 04, 2026, analysis flagged the domain app.xrpl-gov.xyz as an active phishing infrastructure. The domain appears on a single security blocklist and is explicitly blocked by the PhishDestroy service, indicating that threat‑intelligence feeds have identified it as malicious. VirusTotal scans have returned detections from two of ninety‑one antivirus engines, confirming that at least a minority of commercial scanners recognize the domain as suspicious.

No additional public metadata such as page title, SSL certificate details, or hosting information was available at the time of writing, and the underlying hosting provider or IP address could not be correlated with known malicious autonomous system numbers. The limited detection footprint suggests the campaign may be in an early deployment stage or using a low‑profile hosting arrangement to evade broader visibility. Defenders should add app.xrpl-gov.xyz to URL filtering and web‑proxy block lists, enforce DNS sink‑hole rules for the domain, and monitor outbound traffic for connections to the domain.

Continuous re‑scanning on VirusTotal and inclusion in threat‑intel sharing platforms are recommended to capture any escalation in detection rates. Because the domain’s content and target brand have not been publicly disclosed, further investigation of the landing page, HTTP response headers, and any credential‑harvesting forms is advised to determine the specific phishing lure and to develop appropriate user‑awareness alerts.