# airdroping.onexrpl.com — SUSPICIOUS

> Warning: airdroping.onexrpl.com poses a low-level crypto drainer risk. Exercise caution and avoid sharing private keys or wallets.

## Summary
PhishDestroy identifies airdroping.onexrpl.com as a low-risk crypto drainer site attempting to steal cryptocurrency assets through deceptive airdrop offers. The domain was registered on February 21, 2026, and remains active despite appearing on one security blocklist.

The site is registered via PDR Ltd. d/b/a PublicDomainRegistry.com and has been flagged by one security vendor on VirusTotal, indicating a level of suspicion though limited detection. The domain's infrastructure and name mimic legitimate crypto airdrops to lure users into revealing sensitive wallet credentials.

Users are advised to avoid interacting with this domain or providing private keys. Monitoring and blocking this domain can reduce exposure, as it remains operational. Staying vigilant against unsolicited crypto airdrop claims is essential for protecting assets.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: alive (HTTP 405)
- Page title: airdroping.onexrpl.com

## Domain Intelligence
- Registered: 2026-02-21 07:01:08
- Registrar: PDR Ltd. d/b/a PublicDomainRegistry.com
- Nameservers: ["dns11.parkpage.foundationapi.com", "dns10.parkpage.foundationapi.com"]

## Detection Status
- VirusTotal: 1 vendors flagged
  Vendors: ["Gridinsoft"]
- Google Safe Browsing: clean
- Blocklists: 1 hits
  Lists: ["PhishDestroy"]

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/f452ad87-b272-4c98-a649-fe5cdf7e3d65
- PhishDestroy: https://phishdestroy.io/domain/airdroping.onexrpl.com/

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/airdroping.onexrpl.com/
Last updated: 2026-03-14