xrplcafelabs[.]com

PhishDestroy investigators have identified xrplcafelabs.com as a generic phishing domain designed to steal credentials or cryptocurrency from victims. The site currently shows a title referencing a fraudulent $SHROOMS allocation claim, impersonating the xShrooms project on the XRP Ledger. The domain has been taken offline, but users should remain vigilant as similar threats may reappear.

Technical analysis reveals that xrplcafelabs.com is flagged by 5 of 95 VirusTotal security vendors and appears on 2 security blocklists. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on June 4, 2026, and resolves to IP address 188.114.96.3. An AlienVault OTX pulse records this domain as a threat, and the SSL certificate is issued by Google Trust Services. The domain's creation date is notably in the future, suggesting possible data manipulation or a typo in reporting.

As the domain is now offline, the immediate risk is neutralized. However, users who may have visited or interacted with the site should monitor their accounts for unauthorized activity and change any credentials that may have been exposed. PhishDestroy recommends avoiding any unsolicited token claims or airdrop offers, verifying official project channels, and using security extensions that block known phishing domains. Future investigations should track if the same threat actor registers similar domains under the same registrar or IP range.