scrapxrp[.]info

scrapxrp.info is currently active and has been observed delivering a crypto‑related phishing campaign. The site presents the page title “Lovable App”, which does not correspond to a known legitimate service, indicating that the content is being used as a lure. The domain was registered on 21 February 2026 through NiceNIC International Group Co., Limited and is hosted on Cloudflare infrastructure (AS13335) with the IP address 188.114.96.3 located in the United States. Cloudflare’s DNS configuration uses the nameservers elaine.ns.cloudflare.com and ignat.ns.cloudflare.com, and the site enforces HSTS and supports HTTP/3, suggesting a modern TLS setup. The TLS certificate is issued by Google Trust Services under the WE1 intermediate, confirming the use of a legitimate certificate chain.

Security‑vendor scanners on VirusTotal have identified the domain as malicious in five out of ninety‑three checks, and the domain appears on two dedicated blocklists, PhishDestroy and ScamSniffer. The domain’s trust score from Gridinsoft is 0 out of 100, reinforcing the malicious classification. HTTP requests receive a 301 redirect, which may be used to funnel victims to a final payload or credential‑capture page, though the target of the redirect has not been disclosed in the current data set. The evidence points to a high‑risk crypto phishing operation, but the exact phishing vector (e.g., credential‑stealing form, malicious download, or wallet address substitution) remains unknown because the page content has not been captured.

Defenders should block network access to 188.114.96.3 and add scrapxrp.info to URL filtering and email security policies. Monitoring for DNS queries to the listed Cloudflare nameservers can provide early detection of attempted connections.