app[.]xrpl-beta[.]xyz

app.xrpl-beta.xyz was observed in active phishing campaigns as of August 04, 2026. The domain appears on a security blocklist, indicating that at least one reputable blocklist provider has categorized it as malicious. VirusTotal analysis shows that 2 of 91 security vendors submitted detections for the domain, confirming that independent scanning engines have identified suspicious activity associated with it. PhishDestroy, a dedicated anti‑phishing service, also lists the domain as blocked, reinforcing the consensus that the site is being used for fraudulent purposes.

No publicly available WHOIS record or registrar information has been disclosed in the current intelligence set, and the underlying hosting infrastructure, IP address range, or autonomous system number have not been published. Likewise, SSL certificate details, HTTP response codes, and page title metadata have not been captured, leaving those vectors unverified at this time. The lack of additional context does not mitigate the existing indicators; the presence on a blocklist and multiple vendor detections are sufficient for a high confidence assessment. Defenders should treat app.xrpl-beta.xyz as a confirmed phishing resource and enforce network‑level denial of any connections to the domain.

Security solutions that rely on URL filtering, DNS sinkholing, or endpoint protection should add the domain to their deny lists. Continuous monitoring of VirusTotal, blocklist feeds, and phishing‑specific feeds is recommended to capture any future changes in detection status. Organizations that have observed traffic to this domain should isolate affected hosts, collect relevant logs, and investigate potential credential compromise. The elevated risk rating reflects the confirmed malicious classification and the active status of the infrastructure.