biddsxrpl[.]com

PhishDestroy identifies biddsxrpl.com as an active cryptocurrency-themed phishing domain currently under investigation. The site mimics legitimate crypto platforms to harvest wallet credentials and seed phrases under the guise of a fake airdrop or promotional campaign. This represents a targeted social-engineering effort against users familiar with XRP Ledger (XRPL) and related blockchain ecosystems. Given the domain’s recent registration and limited detection coverage, defenders should treat this as a high-priority threat until further IOCs are validated.

This domain was flagged by Google Safe Browsing for SOCIAL_ENGINEERING and currently shows 3 out of 95 VirusTotal detections. It resolves to IP address 104.21.60.126 and was registered on April 05, 2026 via NICENIC INTERNATIONAL GROUP CO., LIMITED using a Let’s Encrypt SSL certificate. The combination of a newly created domain, clean VirusTotal score, and presence on a major blocklist suggests an early-stage campaign likely leveraging low-cost infrastructure to evade immediate detection. Trust scores remain neutral to low due to the domain’s infancy and lack of historical reputation.

Organizations and individuals should immediately block biddsxrpl.com at the DNS and firewall levels. Users should be warned not to interact with any “XRPL airdrop” or “giveaway” pages linked from social media, ads, or unsolicited emails. Enable wallet software to flag unknown contract interactions and verify all transaction requests offline. Report any incidents involving wallet compromise or exposed seed phrases to incident response teams with IOCs including the domain and IP. Monitor internal DNS logs for queries to biddsxrpl.com and inspect HTTP(S) traffic for requests containing wallet addresses or mnemonic patterns.