xrp-pool[.]app

The domain xrp-pool.app was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on May 18, 2026. The registration date is recent and coincides with the appearance of the infrastructure in threat‑intel feeds. The domain resolves to the IPv4 address 188.114.96.3, which is owned by CloudFlare, Inc. and advertised as being located in Canada. DNS resolution is served by the authoritative name servers kaiser.ns.cloudflare.com and oaklyn.ns.cloudflare.com, confirming that the domain is fully hosted behind CloudFlare's network. The site presents a valid TLS certificate issued by Let’s Encrypt (certificate identifier E7), indicating that HTTPS is correctly configured despite the underlying malicious intent. Automated analysis platforms have raised a high level of concern. VirusTotal records six positive detections out of ninety‑five scanners, and Gridinsoft assigns a trust score of zero out of one hundred. The domain appears on a single security blocklist and has been explicitly flagged by PhishDestroy. An AlienVault OTX pulse references the domain in one threat‑intel entry, and HTTP requests to the host return a 403 status code, a pattern often used to hide malicious pages behind authentication or to impede casual browsing. The available evidence points to a generic phishing operation, likely leveraging the attractive “xrp‑pool” wording to lure victims interested in cryptocurrency services. No payload samples, email templates, or victim reports have been publicly released, leaving the exact phishing vector and targeted brands uncertain. Defenders should block DNS resolution to 188.114.96.3, enforce TLS inspection to observe the content behind the 403 response, and monitor network traffic for attempts to contact the domain. Continuous re‑evaluation is advised as additional indicators may emerge.