app[.]split-xrpl[.]xyz

The domain app.split-xrpl.xyz is currently listed as active and assigned an elevated risk rating. It appears on one public security blocklist and is explicitly blocked by the PhishDestroy service. VirusTotal analysis shows that three out of ninety‑one scanned security vendors have flagged the domain as malicious, indicating that at least a minority of scanners recognize it as a threat.

No additional intelligence such as page title, SSL certificate details, hosting IP, or registrar information has been disclosed, so the underlying infrastructure remains opaque. The limited vendor detections suggest that some security products may not yet recognize the domain, increasing the chance of successful abuse if it is used in phishing campaigns. Defenders should therefore treat the domain as hostile: incorporate it into network‑level deny lists, configure DNS filters to block resolution, and ensure email security gateways flag any messages containing the domain in URLs or links.

Continuous monitoring of threat‑intel feeds for new detections, blocklist additions, or changes in vendor reputation is advised. Because the page content has not been publicly analyzed, analysts should request a safe‑browse snapshot if possible to confirm the payload or credential‑harvesting behavior. Until further evidence emerges, the precautionary stance of blocking and monitoring remains the most effective mitigation.