xrpcompany[.]io

Analysis indicates that the domain xrpcompany.io is actively being used in a high‑risk crypto‑phishing operation. The site was registered on April 12, 2026 and is currently listed as active with a risk level of high. Its only visible page returns an HTTP 403 response and displays the title “Just a moment…”, a pattern frequently observed in credential‑harvesting portals that rely on JavaScript challenges. The domain resolves to the IP address 188.114.97.3, which belongs to CloudFlare, Inc. and is geolocated in Canada. The TLS certificate is issued by Google Trust Services under the WE1 certificate authority, confirming the use of a legitimate‑looking HTTPS front end. Despite the legitimate certificate, the site appears on three security blocklists and has been flagged by PhishDestroy, MetaMask, and SEAL. Open‑source intelligence shows the domain appears in a single AlienVault OTX pulse and receives a Gridinsoft trust score of 0 out of 100, indicating an extremely low reputation. VirusTotal analysis reports that 2 of 95 scanned security engines flagged the domain, reinforcing the suspicion of malicious activity. The observed characteristics, combined with the classification as a crypto scam, suggest the site is designed to lure cryptocurrency users into disclosing private keys or seed phrases. Defenders should add 188.114.97.3 and the hostname xrpcompany.io to network deny lists and enforce DNS‑based blocking at the perimeter. Continuous monitoring of any new DNS resolutions or TLS certificate changes is advised, as threat actors often rotate infrastructure. Incident response teams should also inspect logs for attempts to access the domain and consider user‑education campaigns that highlight the “Just a moment…” page as a potential lure.