myxrp-pass[.]com

Analysis of the domain myxrp-pass.com, created on 21 February 2026 and currently taken offline, indicates a high‑confidence brand‑impersonation campaign targeting the XRP cryptocurrency. The domain is registered through NiceNIC International Group Co., Limited and uses Cloudflare’s authoritative nameservers maria.ns.cloudflare.com and nero.ns.cloudflare.com. DNS resolution points to IP address 188.114.97.3, which belongs to AS13335 (Cloudflare, Inc.) and is geolocated in the United States. No TLS certificate is presented, and the HTTP response returns the generic page title “Just a moment…”, offering no additional context. Threat intelligence from VirusTotal shows that 14 of 95 scanned security vendors flag the domain as malicious, reinforcing the suspicion of abuse.

The site appears on a single public blocklist and has been specifically blocked by the PhishDestroy service. Independent reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, the lowest possible rating. The listed scam type is “Brand Impersonation” with the targeted brand identified as XRP. Because the domain is already offline, direct observation of payloads or credential‑stealing pages is unavailable, leaving the exact malicious content unknown.

Defenders should continue to block the domain at network perimeters, monitor the associated IP address for any re‑use, and add the domain to internal blacklists. Threat‑hunting teams may also query historical logs for any connections to 188.114.97.3 prior to the takedown, and consider correlating user activity against the “Just a moment…” title to identify possible prior exposure. Ongoing surveillance of Cloudflare‑hosted infrastructure is advised, as the provider is frequently leveraged for rapid provisioning of phishing sites. The elevated risk rating reflects the combination of brand targeting, vendor detections, and the zero‑trust score, and warrants continued vigilance.