xrpl-rewards[.]com

This domain is flagged as an elevated-risk brand impersonation threat targeting XRP cryptocurrency users. Analysis indicates the domain is designed to deceive victims into disclosing wallet credentials, seed phrases, or personal information under the guise of official XRP reward programs or account verification processes. The threat type aligns with credential harvesting and financial fraud, leveraging brand trust to exploit users in the cryptocurrency ecosystem. Infrastructure analysis reveals the domain xrpl-rewards.com was registered on February 21, 2026, through NiceNIC International Group Co., Limited. It resolves to the IP address 188.114.96.3 and is protected by Cloudflare, utilizing HSTS and HTTP/3 protocols. The domain appears on two security blocklists (PhishDestroy and OISD) and is flagged by 6 out of 95 security vendors on VirusTotal. The SSL certificate is issued by Google Trust Services, while Gridinsoft assigns a trust score of 0/100, indicating confirmed malicious activity. These technical indicators confirm the domain's role in orchestrating phishing campaigns. Mitigation requires immediate blocking of the domain and its associated IP (188.114.96.3) across all network security controls, including firewalls, DNS filters, and endpoint protection systems. Organizations should update threat intelligence feeds with the domain's indicators of compromise (IOCs) and conduct retrospective log analysis to identify any prior connections. Cryptocurrency users must be educated to verify domain authenticity through official XRP communication channels and avoid interacting with unsolicited reward or verification prompts. Multi-factor authentication (MFA) should be enforced for all wallet and exchange accounts to reduce the impact of credential theft.