getxrp26[.]com

This domain, getxrp26.com, is flagged as an active crypto scam targeting users of the XRP cryptocurrency. Registered on April 6, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, the domain currently resolves to IP address 172.67.156.223, hosted on Cloudflare infrastructure in Canada. Analysis indicates the domain is still operational, though it returns an HTTP 403 status, suggesting access restrictions or a placeholder page titled 'Just a moment...'—a common tactic to evade detection while maintaining infrastructure readiness. Infrastructure review reveals the domain uses Cloudflare nameservers (dale.ns.cloudflare.com and nucum.ns.cloudflare.com) and an SSL certificate issued by Google Trust Services (WE1). The use of Cloudflare is consistent with phishing campaigns aiming to obscure hosting origins and leverage CDN protections. While the domain appears on one security blocklist and is detected by 5 out of 95 vendors on VirusTotal, its presence in a single AlienVault OTX pulse further corroborates its malicious classification. The Gridinsoft trust score of 0/100 reinforces the high-risk assessment. The exact mechanics of the scam remain unclear due to the lack of visible content, but the domain name implies an impersonation of XRP-related services, likely designed to deceive users into disclosing wallet credentials or transferring funds. The 403 status may indicate a temporary measure to avoid automated crawlers or a staging phase before full deployment. Defenders should treat this domain as hostile and prioritize blocking it at the DNS or network level. Monitoring for changes in HTTP status or page content is recommended, as the domain may transition to an active phishing state without notice. Given its recent registration and Cloudflare-backed infrastructure, additional domains with similar naming patterns (e.g., 'xrp' followed by numbers) should be scrutinized for related activity.