armyxrpl[.]app

This domain, armyxrpl.app, poses a targeted credential harvesting threat by impersonating the legitimate XRP community under the guise of a movement or fan group. The site mimics official XRP branding and community engagement portals to deceive users into disclosing sensitive cryptocurrency credentials, particularly seed phrases or private keys. Analysis indicates the domain is designed to exploit trust in the XRP brand, using social engineering tactics to trick visitors into entering confidential information on fraudulent forms or wallet interfaces. Infrastructure analysis reveals multiple high-risk indicators. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with suspicious domains. It resolves to the IP address 104.21.1.150 and is hosted behind Cloudflare, which is commonly used to obfuscate malicious infrastructure. Security vendors have flagged the domain, with VirusTotal reporting 3 out of 95 detections for phishing or credential theft. Additionally, the domain appears on one security blocklist and is currently blocked by PhishDestroy. The SSL certificate is issued by Google Trust Services, which, while legitimate, does not mitigate the underlying malicious intent. Users who visited armyxrpl.app should take immediate action to secure their assets. First, revoke any wallet permissions or sessions that may have been granted to the site. Next, transfer funds from any potentially compromised wallets to new, secure wallets with fresh seed phrases. Monitor accounts for unauthorized transactions and enable multi-factor authentication where available. If seed phrases or private keys were entered on the site, assume the associated wallets are compromised and avoid reusing them. Report the domain to relevant cryptocurrency security teams and consider notifying local cybersecurity authorities to aid in tracking the threat.