xrplswap[.]org

Analysis indicates that xrplswap.org is an active phishing infrastructure observed since its registration on July 9 2026. The domain is hosted on the IP address 186.2.175.35 and uses the authoritative name servers launch1.spaceship.net and launch2.spaceship.net, confirming that the registrar is Spaceship, Inc. The domain’s age of only a few weeks and its rapid appearance on a security blocklist suggest a purposeful, short‑lived campaign. PhishDestroy has already classified the domain as blocked, and it appears on one additional security blocklist, reinforcing the high‑risk assessment.

VirusTotal analysis shows that one out of ninety‑one scanners flagged the domain, providing independent confirmation of malicious intent. No public Safe Browsing, Open Threat Exchange, or SSL certificate details are currently available, and the HTTP response code and page title have not been disclosed, leaving some operational characteristics unidentified. Defenders should add xrplswap.org to internal block and allow lists, monitor DNS queries for the associated name servers and IP address, and enforce outbound filtering to prevent credential submission to this host.

Given the registrar’s reputation and the lack of mitigating controls, the domain should be treated as high‑confidence malicious and removed from any allow‑list immediately. Ongoing threat‑intel feeds should be consulted for any new detection signatures or observed payloads linked to this infrastructure.