phnix-xrp[.]app

This domain, phnix-xrp.app, was designed to impersonate the XRP brand, likely aiming to trick users into revealing sensitive information or credentials. As a brand impersonation threat, it attempts to appear legitimate by mimicking official XRP services, but its sole purpose is fraudulent gain. The site is currently offline, but its registration history and technical profile reveal clear warning signs.

PhishDestroy's investigation uncovered several red flags. The domain was registered on February 28, 2026, through NiceNIC International Group Co., Limited, a registrar often associated with suspicious domains. It resolves to IP 104.21.12.100 and uses a Let's Encrypt SSL certificate (E7), which provides encryption but does not guarantee legitimacy. VirusTotal data shows that 4 out of 95 security vendors flagged this domain as malicious, and it appears on 3 security blocklists. The page title displayed was "Just a moment...", a common placeholder that suggests the site may have been under construction or attempting to evade detection.

If you visited phnix-xrp.app, do not enter any personal or financial information. Although the site is offline, there is still a risk that similar domains may appear. Monitor your accounts for suspicious activity and consider changing passwords if you used any credentials on the site. PhishDestroy recommends staying vigilant and verifying any XRP-related communications through official channels only.