xrpp-ledgger-whitepaper[.]com

This domain is flagged as a high-risk brand impersonation threat targeting Ledger, a hardware cryptocurrency wallet provider. Analysis indicates the site is designed to deceive users into believing they are accessing legitimate XRP Ledger whitepaper documentation, likely as a pretext for credential harvesting, wallet compromise, or fraudulent investment schemes. The domain specifically mimics Ledger’s branding while presenting content related to Ripple’s XRP Ledger, a common tactic to exploit trust in both entities. Infrastructure analysis reveals the domain was registered on July 01, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious registrations. It currently resolves to the IP address 188.114.96.3, which has been observed in prior phishing campaigns. Detection metrics show minimal coverage, with only 1 out of 95 security vendors flagging the domain as malicious on VirusTotal, suggesting either evasion techniques or recent deployment. The SSL certificate is issued by Google Trust Services, providing a false sense of legitimacy to unsuspecting visitors. No blocklist entries or trust score improvements were identified at the time of analysis, and the domain remains active. Mitigation steps for this specific threat type include immediate blacklisting of the domain and IP address within network security controls. Organizations should deploy indicators of compromise (IOCs) such as the domain, IP, and registrar details into endpoint detection and response (EDR) systems to prevent access. Users should be educated on verifying domain authenticity, particularly for cryptocurrency-related resources, and encouraged to cross-reference official Ledger communication channels for legitimate whitepaper or documentation links. Monitoring for similar domains registered through NICENIC INTERNATIONAL GROUP CO., LIMITED may also aid in preemptive detection of related campaigns.