xsololab[.]com

This domain, xsololab.com, is flagged as a high-risk brand impersonation threat targeting the XRP Ledger (XRPL) ecosystem. Analysis indicates the site mimics legitimate airdrop campaigns associated with Xaman and Sologenic, specifically promoting a fraudulent $SOLO LP allocation event. The page title, 'Xaman × Sologenic — XRPL Ecosystem Airdrop · $SOLO LP Allocation,' directly references these entities to deceive users into interacting with malicious smart contracts or disclosing wallet credentials. No explicit drainer kit signatures were detected, but the domain aligns with known tactics used in cryptocurrency scams involving fake token distributions and liquidity pool allocations.

Technical indicators confirm the domain's malicious intent. VirusTotal reports 13 out of 95 security vendors flagging xsololab.com as malicious. The domain was registered on June 3, 2024, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to IP address 172.67.216.126, a Cloudflare-protected endpoint that obscures the true origin of the infrastructure. The domain appears on four security blocklists, including MetaMask, PhishDestroy, SEAL, and ScamSniffer, and employs Let's Encrypt SSL certificates to present a false sense of legitimacy. Technologies detected include HSTS, Cloudflare Browser Insights, and HTTP/3, which are commonly leveraged to evade detection and enhance phishing site performance.

As of the latest assessment, xsololab.com remains active and poses a significant risk to users in the XRPL and broader cryptocurrency communities. The domain's infrastructure, combined with its presence on multiple blocklists, suggests a coordinated effort to target individuals seeking airdrop opportunities. Users are advised to avoid interacting with the domain, revoke any connected wallet permissions, and verify airdrop legitimacy through official channels only. Organizations should update blocklists to include this domain and monitor for related indicators of compromise, such as wallet addresses or smart contract interactions linked to the scam. The remaining risk is classified as high due to the domain's active status and the potential for financial loss among targeted victims.