xrplmarkets[.]co

This domain, xrplmarkets.co, is flagged as an elevated-risk brand impersonation threat targeting Ledger, a well-known cryptocurrency hardware wallet provider. The site presents itself as a premium trading platform under the title 'XRP LEDGER | Premium Crypto & Forex Trading,' a tactic designed to deceive users into believing it is an official or affiliated service. Brand impersonation in this context typically aims to harvest credentials, distribute malware, or facilitate cryptocurrency theft through fraudulent transactions or drainer scripts. The domain’s infrastructure and content suggest a deliberate attempt to exploit trust in the Ledger brand to compromise user assets or sensitive information. Analysis indicates the domain was registered on May 30, 2026, through DYNADOT LLC, a registrar frequently observed in phishing campaigns due to its accessibility and bulk registration options. It resolves to the IPv6 address 2606:4700:3035::6815:211f, hosted behind Cloudflare, a common evasion tactic to obscure server origins and complicate takedown efforts. The SSL certificate is issued by Let’s Encrypt, providing a veneer of legitimacy while offering no inherent security assurance. Detection metrics reveal the domain is flagged by 6 out of 95 security vendors on VirusTotal, with PhishDestroy being the sole blocklist currently listing it. The presence of Tailwind CSS, jQuery, and HTTP/3 further suggests a professionally designed front-end intended to mimic legitimate trading platforms. To mitigate risks associated with this brand impersonation threat, users should immediately cease any interaction with xrplmarkets.co and avoid entering credentials or connecting wallets to the site. Organizations should update blocklists to include the domain and its resolving IP address, while monitoring for similar registrations under the same registrar or hosting provider. Cryptocurrency users are advised to verify official communications exclusively through Ledger’s documented channels and enable multi-factor authentication on all accounts. Security teams should investigate the domain’s infrastructure for additional indicators of compromise, such as associated malware hashes or wallet addresses used in prior campaigns, to preempt further exploitation of the Ledger brand.