xrpillars[.]info

Analysis of xrpillars.info indicates a high-risk crypto scam domain impersonating a legitimate application, as suggested by its page title 'Lovable App' and explicit classification in threat intelligence sources. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, and remains active as of July 12, 2026. Infrastructure analysis reveals the domain resolves to IP address 188.114.97.3, hosted on Cloudflare's network (AS13335) in the United States, with nameservers theo.ns.cloudflare.com and kristin.ns.cloudflare.com. The site employs Cloudflare security features, including HSTS and HTTP/3, alongside Cloudflare Browser Insights for performance monitoring, which may complicate detection and takedown efforts. Security vendors have flagged the domain, with 8 out of 93 engines on VirusTotal identifying it as malicious. It is also listed on at least one security blocklist and is actively blocked by PhishDestroy. The SSL certificate is issued by Google Trust Services (WE1), a common choice for both legitimate and fraudulent sites. The domain currently returns an HTTP 301 redirect, though the destination remains unconfirmed. While the scam type is classified as a crypto scam, the exact mechanics—such as whether it involves fake wallets, investment schemes, or credential harvesting—are not yet detailed in available intelligence. Defenders should treat this domain as actively malicious. Network-level blocking of the IP (188.114.97.3) and domain, along with monitoring for related subdomains or newly registered lookalike domains, is recommended. Given the use of Cloudflare, traditional IP-based blocking may have limited effectiveness, so domain-based controls and endpoint protection rules should be prioritized. Further investigation into the redirect chain and any associated cryptocurrency addresses or payment gateways is advised to disrupt the campaign's infrastructure.