get-xrplfoundation[.]com

This domain, get-xrplfoundation.com, is flagged as a high-risk cryptocurrency phishing site targeting users of the XRP Ledger (XRPL) Foundation. Analysis indicates the domain is designed to impersonate the legitimate XRPL Foundation, likely to harvest credentials or private keys through a cryptocurrency drainer kit. The page title explicitly mimics the official branding, increasing the likelihood of successful social engineering attacks against XRP holders. Infrastructure analysis reveals the domain was registered on June 03, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to the IP address 172.67.148.24 and employs Cloudflare services, including HSTS and HTTP/3, to obfuscate its origin and enhance perceived legitimacy. The SSL certificate is issued by Google Trust Services, further blending with legitimate infrastructure. VirusTotal reports 13 out of 95 security vendors flagging this domain as malicious, and it appears on three independent security blocklists. Current detection status indicates active blocking by cryptocurrency wallet extensions and anti-phishing tools. As of the latest assessment, the domain remains active and unresolved in Google Safe Browsing (GSB) databases. The high-risk classification is upheld due to the domain's persistent operational status and its association with cryptocurrency theft infrastructure. Users are advised to treat any interaction with this domain as malicious and to verify XRPL Foundation communications exclusively through official channels. Organizations should update web filters and endpoint protection rules to block both the domain and its resolving IP address to mitigate exposure.