xrp26[.]io

The domain xrp26.io was registered on June 2, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is hosted behind Cloudflare infrastructure (IP 188.114.96.3, located in Canada). It presents a TLS certificate issued by Let’s Encrypt (identifier YE1) and returns an HTTP 403 status code. The only visible page element is the title "Just a moment...". Nameservers shubhi.ns.cloudflare.com and julian.ns.cloudflare.com resolve the domain to the Cloudflare edge node, a pattern commonly observed in fast‑deployed malicious sites.

Threat intelligence classifies xrp26.io as a generic phishing site with a high risk rating and an active status. VirusTotal scans have flagged the domain by 4 of 95 security vendors, and Gridinsoft assigns a trust score of 0 out of 100. The domain appears on three independent security blocklists, reinforcing the suspicion of malicious use. The combination of a recent registration date, low trust scores, and the phishing designation indicates that the site is likely being used to harvest credentials or deceive users.

Uncertainty remains regarding the specific payload or targeted brand, as the site returns a 403 response and no additional content can be retrieved without further interaction. No malware hashes, command‑and‑control endpoints, or exfiltration patterns have been observed publicly, leaving the exact phishing vector and victim profile undefined.

Defenders should treat xrp26.io as hostile. Recommended actions include blocking DNS resolution for the domain, denying outbound connections to 188.114.96.3 at the network perimeter, and adding the domain to local threat blocklists. Monitoring for any changes in the TLS certificate, page content, or response codes is advised, as alterations could signal the activation of a phishing campaign. Continuous updates to intrusion detection signatures to incorporate the domain and its associated IP will help mitigate potential exposure.