phoenix-xrp[.]next-cryptolist[.]net

The domain phoenix-xrp.next-cryptolist.net has been classified as a generic phishing threat, specifically targeting users of the XRP cryptocurrency ecosystem. This site masquerades as a legitimate platform to harvest credentials or funds, but no specific brand or drainer kit has been identified in the available intelligence. PhishDestroy analysts have flagged it as a high-risk entity due to its deceptive nature and active status.

Technical indicators reveal a concerning picture: VirusTotal shows 1 out of 95 security vendors flagging the domain, indicating limited but credible detection. The domain was registered on April 11, 2026, through Key-Systems GmbH, and resolves to IP address 104.21.64.107. Its SSL certificate is issued by Google Trust Services (WE1), which gives it a veneer of legitimacy. Additionally, the domain appears on one security blocklist, confirming it has been previously identified as malicious. Google Safe Browsing status is not specified, but the low blocklist count suggests recent activation.

Currently, the domain remains active and poses an ongoing risk to users searching for XRP-related services. PhishDestroy recommends that users avoid visiting the site, never enter credentials or financial information, and report any phishing attempts to relevant authorities. While no immediate takedown has been reported, continued monitoring is advised as the threat may evolve. Users should rely on official channels for cryptocurrency transactions and remain vigilant against socially engineered attacks.