drop-xrpl[.]live

The domain drop-xrpl.live is currently flagged as a high‑risk generic phishing site. It serves a page titled “Cold Storage in Your Pocket | Xaman” and returns HTTP 200, indicating an active web service. The site appears on three public security blocklists and has been listed by multiple phishing‑specific feeds, confirming its malicious intent. Infrastructure analysis shows the domain resolves to the Cloudflare edge address 188.114.96.3, which is geolocated to Canada. The authoritative nameservers are ada.ns.cloudflare.com and will.ns.cloudflare.com, both owned by Cloudflare, and the site negotiates HTTP/3 over a TLS certificate issued by Google Trust Services (WE1). The domain was registered on July 11 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED. Threat intelligence corroborates the phishing classification. The domain is present in two AlienVault OTX pulses and is blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal scans have triggered detections from three of ninety‑five security vendors, providing additional confirmation of malicious content. However, the specific payload or credential‑harvesting technique employed by the site has not been publicly disclosed, leaving the exact attack vector uncertain. Defenders should treat drop-xrpl.live as hostile. Immediate mitigation steps include adding the domain to DNS blocklists, firewall deny rules, and proxy filtering policies. Continuous monitoring of DNS queries for the domain and its associated IP address is advised, as the underlying Cloudflare infrastructure could be leveraged for fast‑flux style redirection. Organizations that handle cryptocurrency wallets or private keys should be warned that the page title references “Cold Storage,” a common lure for credential theft, and users should be instructed to avoid any unsolicited requests to this domain.