xrptrump[.]net

Analysis of xrptrump.net shows a newly registered domain created on July 28, 2026 and operated under the registrar NICENIC INTERNATIONAL GROUP CO., LIMITED. The domain resolves to the IP address 104.21.21.222 and is served through Cloudflare infrastructure, using the nameservers buck.ns.cloudflare.com and shubhi.ns.cloudflare.com. TLS termination is provided by a Google Trust Services certificate (WE1), indicating a valid HTTPS connection. Google Safe Browsing has flagged the domain for social engineering, and PhishDestroy has added it to its blocklist, confirming active malicious use.

The domain appears on a single external security blocklist, reinforcing the indication of abuse. VirusTotal has processed the site with 91 scanning engines, none of which reported detections at the time of analysis; this absence of detections does not imply the domain is safe. The current status is listed as active, and the domain remains reachable. No public page content, page title, or specific phishing kit details have been disclosed, leaving the exact payload and targeted brand undefined.

Defenders should treat xrptrump.net as high‑risk based on its creation date, blocklist presence, and Safe Browsing classification. Recommended mitigations include adding the domain and its resolved IP to DNS and proxy deny lists, monitoring outbound connections to the 104.21.21.222 address, and applying URL filtering rules that block known malicious domains flagged for social engineering. Continuous re‑evaluation is advised, as threat actors may alter hosting or deploy additional indicators over time.