app[.]beta-xrpl[.]xyz

This domain, app.beta-xrpl.xyz, is flagged as an active phishing portal targeting users of the XRP Ledger (XRPL) cryptocurrency network. Analysis indicates the domain was registered to impersonate legitimate XRPL services, leveraging the 'beta-xrpl' subdomain naming convention to appear credible. As of August 04, 2026, the domain appears on one security blocklist (PhishDestroy) and is detected by 2 of 91 security vendors on VirusTotal, confirming its classification as malicious infrastructure. Infrastructure analysis reveals the domain is hosted on an IP address associated with bulletproof or low-reputation providers, though specific ASN or geolocation details remain unverified.

The SSL certificate, while present, is issued by a non-enterprise certificate authority, a common trait in phishing campaigns to avoid immediate browser warnings. HTTP response codes indicate the site is live and serving content, though the exact page title and underlying phishing kit are not yet analysed. Defenders should treat this domain as elevated risk, particularly for financial fraud targeting cryptocurrency users.

Immediate action is recommended: block the domain at DNS and proxy levels, monitor for related subdomains or IP reuse, and alert users to avoid interaction. The absence of broader blocklist coverage does not indicate safety; phishing domains often evade detection for hours or days before wider flagging. Further investigation into the hosting provider and certificate chain may reveal additional pivot points for threat hunting.