app[.]xrpl-prelaunch[.]xyz

Analysis of the domain app.xrpl-prelaunch.xyz as of 2026-08-04 shows that it is actively leveraged in credential-harvesting campaigns. VirusTotal records indicate that 2 of 91 scanned security vendors have flagged the domain as malicious, providing early evidence of abuse. The domain also appears on a single security blocklist and is listed as blocked by the PhishDestroy service, confirming that at least one external mitigation platform has taken preventive action. Publicly available infrastructure details remain sparse.

No registrar information, IP address, hosting provider, SSL certificate data, HTTP response codes, Safe Browsing verdicts, or Open Threat Exchange (OTX) entries have been published for the domain at the time of analysis. Likewise, page-title metadata and any associated evidence links have not been disclosed. The lack of these attributes limits the ability to fully map the attacker’s hosting environment, but the existing detections are sufficient to warrant precautionary measures. Defenders should incorporate app.xrpl-prelaunch.xyz into domain-based blocklists across email gateways, web proxies, and endpoint security solutions.

Monitoring of DNS queries for the domain and any newly resolved IPs is advised, as well as periodic re-assessment of VirusTotal and blocklist status for emerging detections. Organizations that encounter traffic to this domain should treat any credential-submission attempts as malicious and block the request. Ongoing intelligence collection is recommended to capture additional infrastructure indicators that may emerge.