xrp-update[.]io

Analysis of the domain xrp-update.io indicates an active brand-impersonation campaign targeting users of the XRP cryptocurrency. The domain was registered on 21 February 2026 and resolves to the IP address 104.21.68.102, which belongs to Cloudflare, Inc. (ASN 13335) and is geolocated in the United States. The site presented the page title "xrp-update.io", matching the domain name, and used an SSL certificate identified as "WE1".

Reputation services show a Gridinsoft trust score of 0/100 and the domain appears on a single security blocklist. Seven of ninety-three VirusTotal scanners flagged the domain as malicious, and the activity was subsequently blocked by the PhishDestroy feed, after which the site was taken offline. The evidence confirms a brand-impersonation threat, but the exact content served—such as credential-stealing forms or malicious downloads—has not been publicly disclosed.

Consequently, the full scope of the campaign, including any compromised accounts or payloads, remains uncertain. Defenders should continue to monitor the DNS resolution of 104.21.68.102 for re-use, enforce URL filtering for the exact domain, and consider adding the domain to internal blocklists. Ongoing scanning with multi-engine services is advised to capture any future changes, and any observed traffic should be logged for correlation with potential XRP-related fraud incidents.