phnix[.]app

This domain, phnix.app, is flagged as a generic_phishing threat targeting users of the XRP cryptocurrency ecosystem. The page title, PHNIX - The Mascot of XRP, suggests an attempt to impersonate an official or promotional entity associated with XRP, likely aiming to harvest credentials, private keys, or other sensitive financial information. No specific drainer kit signatures were identified in the initial analysis, but the use of a mascot-themed lure is consistent with social engineering tactics observed in cryptocurrency phishing campaigns. Infrastructure analysis reveals the domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited. It resolves to the IP address 188.114.97.3, which is associated with Cloudflare infrastructure. The domain appears on one security blocklist and has a Gridinsoft trust score of 0/100. VirusTotal reports 13 out of 95 security vendors flagging the domain as malicious. The SSL certificate is issued by Google Trust Services, and the site employs technologies including Framer Sites, React, HSTS, Cloudflare, and HTTP/3, which are commonly used in both legitimate and malicious deployments. The domain is currently offline, having been taken down following detection and reporting. However, residual risk remains due to the potential for re-registration or migration to a new domain. Users who interacted with this domain are advised to revoke any permissions granted to associated wallets or applications, rotate credentials, and monitor for unauthorized transactions. Organizations should update blocklists to include this domain and its resolved IP address, while security teams should correlate logs for any prior connections to 188.114.97.3 or related infrastructure.