trumpxrp[.]net

Analysis of trumpxrp.net indicates an active high‑risk generic phishing infrastructure. The domain was registered on July 28, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is served by Cloudflare nameservers scott.ns.cloudflare.com and susan.ns.cloudflare.com. DNS resolution points to the IP address 104.21.13.126, a Cloudflare edge node commonly used for fast content delivery and often abused for malicious hosting. The domain appears on a single security blocklist and has been flagged by Google Safe Browsing for social engineering, confirming that the URL is associated with deceptive content.

VirusTotal records show that the site was scanned by 91 antivirus and URL‑reputation engines, none of which generated a detection at the time of analysis; this absence of detections does not imply safety, as many phishing pages evade automated signatures. PhishDestroy has already blocked the domain, yet the site remains reachable, indicating that the blocklist entry alone has not fully disrupted the operation. No public page title, SSL certificate details, or HTTP response codes have been disclosed, leaving the exact appearance and content of the site unverified.

Defenders should add trumpxrp.net to network‑level deny lists, enforce URL filtering based on the Google Safe Browsing verdict, and monitor for any outbound connections to the associated Cloudflare IP. Continuous re‑scanning on platforms such as VirusTotal is advised to capture any future payload changes. The combination of recent registration, Cloudflare hosting, and active safe‑browser warnings underscores the need for proactive mitigation despite the current lack of malware detections.