xrp-etf[.]ai-cryptolist[.]com

This domain is flagged as an elevated-risk cryptocurrency credential phishing site targeting users through deceptive investment-themed lures. Analysis indicates the infrastructure was designed to harvest wallet credentials and personal data under the guise of a Ripple (XRP) exchange-traded fund (ETF) opportunity. The threat type aligns with targeted financial fraud, exploiting current trends in digital asset investment to maximize victim engagement. Infrastructure analysis reveals the domain was registered through Key-Systems GmbH on April 11, 2026, an unusually forward-dated creation that may indicate an attempt to evade immediate detection. The domain resolves to IP address 188.114.96.3 and is currently offline, though it previously presented a Cloudflare interstitial page titled 'Just a moment...' as part of its evasion tactics. Security telemetry shows the domain appears on two blocklists and is flagged by 18 of 95 engines in aggregated threat intelligence platforms. The SSL certificate is issued by Google Trust Services, providing a false sense of legitimacy. Additional indicators include a Gridinsoft trust score of 0/100 and active blocking by two specialized anti-phishing systems. Mitigation requires immediate action from both individual users and network administrators. End users should verify all cryptocurrency-related communications through official channels and never enter wallet credentials on untrusted sites. Network-level protections should include DNS filtering to block resolution of the domain and its associated IP address. Security teams should monitor for related indicators, including the registrar Key-Systems GmbH and the resolving IP 188.114.96.3, which may host additional malicious infrastructure. Given the domain's offline status, continuous monitoring for reactivation is recommended, particularly during periods of heightened cryptocurrency market activity.