eligibility-app[.]ripple-exrp[.]com

This domain, eligibility-app.ripple-exrp.com, was registered through ENOM, INC. on February 21, 2026 and is currently taken offline. The authoritative nameservers are dns1.dnshost.to and dns2.dnshost.to. DNS resolution points to IP 216.126.225.137, which belongs to AS14956 RouterHosting LLC in the United States. No TLS certificate is presented, so all HTTP traffic would be unencrypted.

The site returns a page with the title “Access Restricted”, and a Gridinsoft trust score of 0 out of 100, indicating a high likelihood of malicious intent. The domain appears on one external security blocklist and has been flagged by PhishDestroy. VirusTotal analysis shows that 10 of 93 scanned security vendors classify the domain as malicious. The threat is identified as a brand impersonation campaign targeting the cryptocurrency XRP and is associated with an account takeover scam. Evidence confirms the impersonation claim but no additional payload or command‑and‑control infrastructure has been publicly disclosed.

Uncertainty remains regarding the exact phishing landing page content and whether the domain was ever used to harvest credentials before being taken offline. Defenders should block the domain at the DNS and firewall layers, monitor for any outbound connections to the associated IP address, and add the IP and its ASN to threat‑intelligence feeds. Continuous monitoring of the hosting provider and related DNS entries is recommended, as the attacker may reuse the same infrastructure for future campaigns. Organizations that handle XRP‑related accounts should alert users to the impersonation attempt and enforce multi‑factor authentication to mitigate account‑takeover risk.