xrp[.]promo

This domain is flagged as a credential harvesting site designed to mimic legitimate XRP cryptocurrency services. Analysis indicates it specifically targets users of Ripple-based wallets, tricking visitors into entering private keys, recovery phrases, or login credentials under the guise of promotional offers or account verification processes. The site employs social engineering tactics, including fake reward claims and urgent security alerts, to pressure victims into disclosing sensitive information. Infrastructure analysis reveals the domain was registered on May 21, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to the IP address 172.67.202.223 and uses a Let's Encrypt SSL certificate to create a false sense of legitimacy. Security vendors have flagged the domain in 15 out of 95 scans on VirusTotal, and it appears on two independent blocklists, including PhishDestroy and InversionDNS. Additionally, it has been documented in one threat intelligence pulse on AlienVault OTX, further confirming its malicious intent. If you visited xrp.promo or entered any credentials, immediately cease all interaction with the site. Revoke access to any connected wallets or accounts and transfer remaining funds to a new, secure wallet address. Enable multi-factor authentication on all cryptocurrency-related accounts and monitor for unauthorized transactions. Scan your device for malware using updated security tools, as phishing sites often deploy secondary payloads. Report the incident to your wallet provider and relevant cybersecurity organizations to assist in tracking and mitigating the threat. Avoid clicking on links from unsolicited messages, even if they appear to originate from known services.