aliensonxrpl[.]com

PhishDestroy identifies aliensonxrpl.com as an active crypto phishing domain impersonating XRP Ledger to harvest wallet credentials and execute unauthorized transfers. The threat type is classified as a generic_phishing campaign specifically targeting users of the XRP Ledger ecosystem. The domain’s infrastructure suggests a drainer kit is in use, designed to mimic official XRP Ledger login portals and deceive victims into entering sensitive wallet recovery phrases or private keys. The domain aliensonxrpl.com was registered through Cloudflare, Inc., with a creation date of September 18, 2025. It resolves to IP address 104.21.15.240 and is secured with an SSL certificate issued by Google Trust Services. As of the latest scan, VirusTotal reports 0 detections out of 95 engines, indicating it remains under the radar of most antivirus systems. The domain has not been flagged by Google Safe Browsing (GSB) and currently appears on zero public blocklists. These technical indicators suggest a recently deployed and minimally detected threat infrastructure. The domain remains active and under investigation, with no confirmed takedown or remediation as of this report. Users are advised to avoid interacting with aliensonxrpl.com and verify any XRP Ledger-related domains via PhishDestroy’s threat database. Remaining risk is elevated due to the domain’s recent registration, lack of blocklist presence, and the ongoing nature of crypto drainer campaigns. Security researchers are encouraged to monitor this domain for updates and potential IOC expansion.