xrphtoken[.]xyz

PhishDestroy identifies XRPHtoken.xyz (xrphtoken.xyz) as an active crypto drainer domain impersonating XRP token services to siphon cryptocurrency assets. The domain remains operational as of the latest analysis, with evidence of ongoing phishing campaigns targeting XRP investors. Initial observations suggest the infrastructure is designed to trick victims into connecting wallets or entering credentials under false pretenses, leading to unauthorized fund transfers. This domain was flagged by 1 of 95 VirusTotal vendors as of the report date, indicating limited detection coverage despite clear malicious intent. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, resolving to IP address 188.114.96.3. XRPHtoken.xyz was created on May 27, 2026, and has not yet appeared on major blocklists. Domain trust scores remain critically low, with no positive reputation indicators. The lack of detections on VirusTotal highlights the evasiveness of this threat and the need for proactive blocking. Given the active status and absence of third-party detections, XRPHtoken.xyz poses a significant risk to XRP holders and cryptocurrency users interacting with token-related services. Organizations and individuals should immediately block all communications with this domain and its associated IP address (188.114.96.3). Enhance monitoring for wallet connection attempts or credential input fields referencing this domain. If exposure has occurred, assume compromise of cryptocurrency assets and initiate incident response procedures. Always verify the legitimacy of token-related domains through official channels and use hardware wallets for high-value transfers.