claim-xrphealthcare[.]xyz

This domain, claim-xrphealthcare.xyz, is actively operating as a crypto drainer phishing site designed to steal digital wallet credentials and drain cryptocurrency assets. The site masquerades as XRP Healthcare, a legitimate project, by using branding elements such as the page title 'XRP Healthcare | AI Healthcare, Pharmacy Access and XRPH AI App.' Victims are lured into connecting their wallets under the pretense of accessing AI-driven healthcare services or exclusive token distributions, only to have their funds siphoned through malicious smart contract interactions or credential harvesting scripts. Analysis indicates this domain was registered on June 26, 2024, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. As of the latest scan, only 3 out of 95 security vendors on VirusTotal have flagged the domain, suggesting low initial detection rates that may increase as more engines update their signatures. The site resolves to the IP address 104.21.31.156, a Cloudflare proxy endpoint commonly used to obscure hosting infrastructure and evade takedowns. The SSL certificate is issued by Google Trust Services, providing a false sense of legitimacy to unsuspecting users. If a user has visited claim-xrphealthcare.xyz or interacted with its content, immediate action is required to mitigate risk. First, disconnect any connected wallets from the site using a wallet management tool or browser extension. Revoke any suspicious smart contract approvals via a blockchain explorer or dedicated revocation service. Monitor wallet activity for unauthorized transactions and transfer remaining assets to a new, secure wallet if compromise is suspected. Report the domain to relevant security teams, including wallet providers and threat intelligence platforms, to aid in broader detection and takedown efforts. Users should also scan their devices for malware, as phishing sites may deploy additional payloads to maintain persistence.