xrplive-korea[.]com

Analysis of the domain xrplive-korea.com indicates it was actively involved in brand impersonation targeting XRP, a cryptocurrency. The domain was registered on February 28, 2026, through Hello Internet Corp and resolved to the IP address 103.101.85.21, hosted under AS207567 (Intezio Worldwide Limited) in Russia. At the time of assessment, the domain was offline, though prior activity included a page titled '1 new message,' a common tactic to lure victims into engaging with phishing content. No SSL certificate was detected, increasing the likelihood of unencrypted communications and potential credential interception.

The domain appeared on three security blocklists, including PhishDestroy, MetaMask, and SEAL, and was flagged by 2 of 93 security vendors on VirusTotal, suggesting moderate but not universal detection. Nameservers were hosted on coco.bunny.net and kiki.bunny.net, infrastructure that has been previously associated with other phishing campaigns. While the exact content of the phishing page remains unconfirmed, the combination of XRP branding, the suggestive page title, and the lack of encryption aligns with known cryptocurrency phishing tactics.

Defenders should treat this domain as compromised and prioritize blocking it at the DNS and network levels. Further investigation into associated infrastructure, particularly the IP and nameserver history, may reveal additional linked threats. Given its current offline status, monitoring for reactivation or domain resurgence under similar naming conventions is recommended.