bearxrpl[.]app

Analysis of bearxrpl.app confirms active phishing infrastructure targeting XRP users, as indicated by its registration details, hosting patterns, and security vendor detections. The domain was created on February 21, 2026, and remains operational as of July 12, 2026, resolving to IP address 188.114.97.3. Infrastructure analysis reveals the use of Cloudflare and HTTP/3, common among threat actors to obfuscate origins and evade takedowns. The domain is registered through NiceNIC International Group Co., Limited, a registrar frequently associated with malicious activity. The page title, 'BEAR on XRPL,' explicitly references the XRP Ledger (XRPL), aligning with the confirmed brand impersonation targeting XRP. This domain has been flagged in 23 threat intelligence pulses on a public threat-sharing platform, indicating widespread recognition of its malicious nature. Security vendors have detected the domain, with 5 of 95 engines on a multi-scanner service identifying it as malicious. It is currently blocked by at least two security blocklists, including enterprise-grade protections. Defenders should prioritize blocking this domain at the DNS and network level, as well as monitoring for related infrastructure using the same registrar or hosting patterns. While the exact phishing kit or payload is not yet analyzed, the combination of brand impersonation, active status, and security vendor detections confirms its high-risk classification. Further investigation into associated IP ranges and SSL certificates (issued by Google Trust Services) may reveal additional linked domains or campaigns.