xrpwebseminarca[.]com

Analysis indicates that xrpwebseminarca.com is a fraudulent domain impersonating Ledger, a well-known cryptocurrency hardware wallet provider. The domain was registered on February 23, 2026, through NiceNIC International Group Co., Limited, and was taken offline following detection. Infrastructure analysis reveals the domain resolved to IP address 104.21.9.197, hosted on Cloudflare’s network (AS13335) in the United States. No SSL certificate was present, increasing the risk of unencrypted data transmission. The page title, 'XRP Webinar Hub — Expert Webinars for XRP Holders,' suggests an attempt to lure XRP cryptocurrency holders into a fake webinar, likely as part of a seed phrase phishing scheme, as indicated by the known phishing kit classification.

Security vendors flagged the domain on VirusTotal, with 4 out of 93 engines detecting malicious activity. It also appears on at least one security blocklist, and PhishDestroy has blocked access to the site. The domain’s nameservers (blakely.ns.cloudflare.com and dimitris.ns.cloudflare.com) are consistent with Cloudflare’s infrastructure, which is frequently used by threat actors to obscure hosting origins. While the domain is currently offline, its prior infrastructure and known associations with seed phrase phishing warrant caution.

Defenders should treat any prior interaction with this domain as a potential compromise of cryptocurrency wallet credentials. Organizations should monitor for related indicators of compromise, including the IP address and nameserver associations, and update blocklists accordingly. Users who may have engaged with the site should immediately revoke access to any linked wallets and review transactions for unauthorized activity. The absence of an SSL certificate further underscores the domain’s lack of legitimacy, as legitimate financial or cryptocurrency platforms typically enforce HTTPS.