xrplfrlusd[.]com

This domain, xrplfrlusd.com, is actively flagged as a high-risk phishing site targeting cryptocurrency users, specifically those associated with the XRP Ledger (XRPL) ecosystem. As of July 29, 2026, the domain appears on two security blocklists and is blocked by PhishDestroy and ScamSniffer, both of which specialize in phishing and scam detection. Google Safe Browsing has classified the site under 'social engineering,' indicating it is designed to deceive users into divulging sensitive information or performing actions that compromise security. VirusTotal reports that 13 out of 91 security vendors have flagged the domain as malicious, though the exact nature of the threat—such as whether it hosts a crypto wallet drainer, fake token swap, or credential harvesting page—remains unconfirmed due to limited technical analysis of the site's content.

Infrastructure details, including hosting provider, IP address, and SSL certificate issuer, are not provided in the available intelligence. The domain's registration date and registrar are also unspecified, limiting further assessment of its operational timeline or potential ties to broader phishing campaigns. Defenders should treat this domain as an active threat, particularly for users interacting with XRP-related services or wallets.

Immediate action includes blocking the domain at the DNS or network level, alerting security teams to monitor for related indicators of compromise (IoCs), and advising users to avoid interaction with the site. If additional evidence emerges—such as page content analysis or connection to known phishing kits—further classification of the scam type may be possible. For now, the domain should be considered a confirmed phishing asset with a focus on cryptocurrency fraud.