xrp-26[.]money

This domain, xrp-26.money, was registered on 21 February 2026 through NiceNIC International Group Co., Limited and immediately pointed to the Cloudflare edge address 104.21.9.250 (AS13335, United States). The hosting infrastructure includes Cloudflare DNS with the authoritative nameservers leah.ns.cloudflare.com and titan.ns.cloudflare.com and serves content over HTTP/3. TLS termination is provided by Google Trust Services under the WE1 certificate, indicating a legitimate certificate chain but not mitigating the malicious intent. HTTP requests return a 403 status and the page title observed during the last crawl reads “xrp-26.money | 522: Connection timed out”, suggesting the site was configured to present a Cloudflare error page rather than malicious content at the time of observation.

VirusTotal analysis shows five of ninety‑three scanners flagging the domain, and the domain appears on a single external blocklist, where it has also been listed by PhishDestroy. The site is classified as a crypto‑scam that impersonates the XRP brand, aligning with the reported brand target. Current monitoring indicates the domain is offline, but threat actors may reactivate the domain or reuse the underlying infrastructure for future campaigns. Defenders should add 104.21.9.250 to network deny lists where feasible, enforce DNS filtering for the exact domain, and monitor for any resurgence of activity.

Given the use of a shared Cloudflare IP, blanket blocking of the address may impact legitimate services; therefore, domain‑level filtering is preferred. Continuous threat‑intel feeds should be consulted for any re‑registration or new aliases that reuse the same registrar or nameserver pattern. Organizations handling XRP transactions should increase user awareness, confirm URLs against official sources, and consider implementing email and web gateway rules that flag communications referencing “xrp-26.money”.