fedexpressdelivery[.]org[.]tripplefxtrading[.]com

The domain fedexpressdelivery.org.tripplefxtrading.com was registered on 21 February 2026 and is presently taken offline. Analysis shows the site presented the page title “FED Express Delivery” and claimed to impersonate the cryptocurrency brand XRP. The SSL certificate is identified as type R11, providing no indication of extended validation. Reputation scoring from Gridinsoft returned a zero out of one hundred, indicating a lack of trust.

The domain was flagged by the PhishDestroy blocklist and appears on a single additional security blocklist, confirming that at least one external mitigation service has taken action. VirusTotal scans recorded a single positive detection out of ninety‑three AV engines, suggesting limited but existent malicious indicator presence. No further public blocklist entries, Safe Browsing alerts, or Open Threat Exchange (OTX) references were observed. Hosting details, registrar information, and IP address data were not disclosed in the supplied intelligence, and therefore cannot be evaluated for infrastructure risk.

The combination of a recent creation date, low trust score, targeted brand impersonation, and the presence of a positive AV flag warrants an elevated risk rating. Defenders should continue to monitor the domain for any re‑activation, enforce blocklist rules that include this exact FQDN, and consider adding the domain to internal deny lists. Additional scrutiny of any DNS or SSL certificate changes is recommended, as such modifications could indicate a revival of the phishing campaign.