earn-xrpl[.]xyz

Analysis on earn-xrpl.xyz as of 2026-08-03 indicates that the domain is actively used in a generic phishing campaign. The site was submitted to VirusTotal and scanned by 91 antivirus and URL-reputation engines; none of the scanners raised a detection, but the lack of a positive result does not constitute evidence of benign intent. Independent mitigation services have already taken action: PhishDestroy, MetaMask, and SEAL list the domain as blocked, and it appears on three external security blocklists, reinforcing the view that the domain is associated with malicious activity.

No public information about the registrar, registration date, hosting provider, IP address, or TLS certificate is currently available in the shared intelligence, limiting the ability to perform a deeper infrastructure correlation. Likewise, the page title, target brand, or underlying phishing kit have not been disclosed, leaving the exact impersonated service unidentified.

Defenders should continue to treat earn-xrpl.xyz as a high-confidence indicator of phishing, enforce network-level blocking, and incorporate the domain hash into existing URL-filtering solutions. Monitoring for any new sightings, changes in hosting attributes, or emergence of associated payloads is recommended, as further evidence may emerge that clarifies the campaign’s scope and target audience.