xrpl-distribute[.]live

The domain xrpl-distribute.live was registered on July 22, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently resolvable to the IP address 172.67.183.156, which is served by Cloudflare nameservers carmelo.ns.cloudflare.com and connie.ns.cloudflare.com. The domain is active as of the report date (July 26, 2026) and has been observed on a single security blocklist, specifically PhishDestroy. A VirusTotal scan performed by 91 independent scanning engines returned no positive detections; however, the absence of detections does not constitute evidence of legitimacy and the domain remains classified as a generic phishing site based on available intelligence.

The limited visibility of the site—no publicly disclosed page title, brand target, or detailed content analysis—means that the exact phishing vector, lure, or credential collection mechanism cannot be confirmed at this time. Infrastructure analysis indicates that the use of Cloudflare’s edge network provides the attacker with basic anonymity and resilience, while the recent registration date suggests a short-lived campaign intended to exploit timely interest in XRP‑related services.

Defenders should prioritize blocking the domain at the DNS and proxy layers, monitor outbound connections to the associated IP address, and include the domain in existing phishing detection rules. Continuous re‑evaluation is recommended, as future scans may yield detections or additional intelligence that could refine the threat profile and inform incident response actions.