drop-xrpl[.]com

Analysis of drop-xrpl.com indicates that the domain was registered on April 23, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently taken offline, returning HTTP 403 responses. The domain resolves to Cloudflare IP address 188.114.96.3, which is associated with Cloudflare, Inc. in Canada. An SSL certificate issued by Let’s Encrypt (E8) is present, and the site served HSTS, HTTP/3, and resources from cdnjs, Chart.js, and Cloudflare Browser Insights, suggesting a typical Cloudflare‑protected web service.

The page title observed before takedown was "Token Dashboard · XRPL," indicating an attempt to mimic a legitimate XRPL token dashboard interface. Gridinsoft assigned a trust score of 0 out of 100, and the domain appears on a single security blocklist, blocked by PhishDestroy. AlienVault OTX recorded the domain in one threat‑intel pulse, and VirusTotal reported four detections out of ninety‑four scanning engines, reinforcing the malicious assessment.

The limited detection footprint and the recent registration date leave open questions regarding the scale of the campaign, the specific phishing payload, and whether the site was actively harvesting credentials before being shut down. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any residual traffic to the associated Cloudflare IP, and update internal phishing filters with the observed page title and associated technologies. Incident response teams should also consider reviewing user reports for any attempted interactions with the XRPL token dashboard that reference this domain, and enforce multi‑factor authentication for XRPL‑related services to mitigate credential compromise.