xrpldesktop[.]app

xrpldesktop.app has been flagged as an active phishing domain targeting XRP Ledger users through a fraudulent wallet application. The domain mimics legitimate XRP wallet interfaces to trick users into entering seed phrases or private keys. No known drainer kit or brand impersonation was identified at the time of analysis; however, the threat remains credible due to the domain’s misspelling of 'XRP Ledger' and its app-like presentation. The infrastructure leverages deceptive naming to exploit user trust in cryptocurrency tools.

This domain resolves to IP 216.150.1.1 and was registered on March 22, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. It holds a valid SSL certificate issued by Let's Encrypt, which may enhance its credibility to potential victims. VirusTotal currently reports 4/95 detections, indicating it has yet to be widely blacklisted or flagged by security vendors. The domain is not currently blocked by Google Safe Browsing (GSB) and remains absent from major threat intelligence feeds.

xrpldesktop.app is classified as an active phishing threat under investigation, with a unique seed identifier of 10ed28. The current risk level is undetermined pending further analysis. Users are advised to avoid this domain and verify wallet URLs through official XRP Ledger channels. No takedown actions have been confirmed; the domain remains operational as of this assessment. Remaining risk includes potential credential theft or fund loss for users who interact with the fraudulent site.