verify-xrp[.]cafe

Analysis of the domain verify-xrp.cafe shows a newly registered Internet resource that is actively used for credential phishing. The domain was created on August 03, 2026 and is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. DNS resolution points to the single IPv4 address 188.114.97.3, and the authoritative name servers are garrett.ns.cloudflare.com and virginia.ns.cloudflare.com, indicating Cloudflare provisioning.

The domain appears on three external security blocklists and has been explicitly blocked by the PhishDestroy, MetaMask, and SEAL filtering solutions, confirming that defensive products recognize it as malicious. VirusTotal scans report that two of ninety‑one security vendors have flagged the domain, providing independent corroboration of its malicious nature. No additional intelligence such as SSL certificate details, HTTP response codes, or page title information is currently available, leaving the exact phishing payload and target brand unverified.

Defenders should continue to deny any network traffic to 188.114.97.3, enforce blocklist rules that include verify-xrp.cafe, and monitor for any new indicators that may emerge from the hosting provider. Organizations that rely on credential‑based authentication, especially those interacting with cryptocurrency services, should educate users about the risk and enforce multi‑factor authentication to mitigate credential theft. The continued presence of the domain on multiple blocklists and its recent creation date suggest an active campaign, and the threat should be treated as high risk until takedown or remediation is confirmed.