xrpcore2x[.]com

Analysis indicates that the domain xrpcore2x.com was registered on 21 February 2026 through Web Commerce Communications Limited dba WebNic.cc. The sole page title returned is "xrpcore2x.com", providing no additional context. DNS resolution points to 172.67.170.125, an address owned by Cloudflare, Inc. (ASN 13335) and geolocated to the United States. The SSL certificate presented is identified as WE1; no further validation details are available.

The domain has been classified as a brand‑impersonation campaign targeting the x.com brand. Independent scanning on VirusTotal shows that nine out of ninety‑three security vendors flagged the domain, confirming malicious intent. Gridinsoft assigned a trust score of 0/100, and the domain appears on a single external blocklist. PhishDestroy has already taken the domain offline, and the current status is reported as offline.

Uncertainties remain regarding the exact malicious payload or landing page, as no content analysis has been published and the page title offers no insight into the tactics employed. The limited blocklist presence and the modest vendor detection count suggest that the infrastructure may be newly deployed or intentionally low‑profile. Defenders should add 172.67.170.125 to network‑level deny lists, monitor for any traffic to Cloudflare‑served IP ranges that match the domain, and enforce brand‑specific URL filtering for attempts to resolve xrpcore2x.com. Continuous re‑scanning on multi‑vendor platforms is recommended to capture any subsequent changes, and any internal alerts that reference x.com impersonation should be correlated with this indicator.