xrpact[.]io

Analysis indicates that the domain xrpact.io was registered on 15 May 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED. The authoritative name servers aiden.ns.cloudflare.com and kia.ns.cloudflare.com resolve the domain to the IP address 104.21.69.109, which belongs to Cloudflare's network. The domain has been observed by the phishing mitigation service PhishDestroy and appears on one public blocklist, suggesting that at least one security vendor has taken action to restrict its traffic. VirusTotal reports that 18 of 91 scanned security engines flag the domain as malicious, providing additional confirmation of its nefarious reputation.

The combination of recent registration, Cloudflare hosting, and multiple vendor detections aligns with typical infrastructure patterns used by operators of generic phishing campaigns. No further public intelligence such as Safe Browsing status, OTX indicators, SSL certificate details, HTTP response codes, or page title has been disclosed, leaving the exact content and targeted brand of the site unverified. Consequently, defenders cannot determine whether the site impersonates a particular service or leverages a specific phishing kit.

Given the available evidence, security teams should block network connections to 104.21.69.109 and to the domain xrpact.io at DNS and firewall layers. Email filtering solutions ought to incorporate the domain in their block lists and consider the associated detections from VirusTotal as a risk indicator. Continuous monitoring of threat intelligence feeds for any new indicators, such as additional blocklist listings or changes in detection counts, is recommended to maintain up‑to‑date protection against this active phishing infrastructure.