thexrphub[.]com

This domain, thexrphub.com, is under investigation for operating as a crypto drainer scam targeting XRP cryptocurrency holders. Analysis of the page title, 'XRP Elite Circle • Exclusive Access,' indicates an attempt to impersonate a legitimate XRP community or investment opportunity. The site likely employs social engineering tactics to trick victims into connecting wallets or entering private keys, enabling unauthorized fund transfers to attacker-controlled addresses. No specific drainer kit has been confirmed, but the infrastructure aligns with known crypto phishing campaigns. Infrastructure analysis reveals the following technical indicators: the domain was registered on May 25, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, an uncommon registrar for legitimate crypto projects. It resolves to IP address 188.114.96.3, hosted on AS13335 (Cloudflare, Inc.), a common obfuscation tactic. The SSL certificate is issued by Let's Encrypt (serial E7), providing HTTPS encryption to appear legitimate. VirusTotal currently reports 0 detections out of 95 engines, suggesting the domain has not yet been widely flagged. However, it appears on at least one security blocklist, and PhishDestroy has already classified it as malicious. As of this report, thexrphub.com remains active and accessible. The domain’s creation date in 2026 is anomalous, likely a typographical error or intentional misconfiguration to evade detection. Given the absence of detections on major scanning platforms, users may still encounter this site through targeted phishing campaigns or malvertising. Immediate mitigation includes blocking the domain at the network level, reporting it to additional threat intelligence platforms, and alerting the XRP community to prevent financial losses. The remaining risk is elevated due to the domain’s active status and low detection rate.