gem-crossmark-rlusd[.]info

This domain, gem-crossmark-rlusd.info, operates as a high-risk phishing site targeting cryptocurrency users by impersonating an RLUSD priority allocation portal associated with GemWallet, Crossmark, and Ripple. The page title, 'RLUSD Priority Allocation — GemWallet × Crossmark × Ripple,' is designed to deceive users into believing they are interacting with an official token distribution platform. Analysis indicates the site likely harvests wallet credentials or private keys under the guise of exclusive token allocations, a common tactic in cryptocurrency phishing campaigns. Infrastructure analysis reveals multiple red flags. The domain was registered on May 29, 2024, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious domains. It resolves to the IP address 172.67.204.37 and is currently flagged by 3 security blocklists. Detection engines on VirusTotal report 16 out of 95 vendors marking the domain as malicious, with specific blocking by PhishDestroy, MetaMask, and SEAL. The site employs Cloudflare for hosting, which may obscure its true origin, and uses HTTP/3 alongside HSTS to mimic legitimate financial platforms. Users who have visited gem-crossmark-rlusd.info should immediately revoke any wallet permissions granted to the site and transfer assets to a new, secure wallet. It is critical to scan local devices for malware, as phishing sites may deploy additional payloads. Monitor transaction histories for unauthorized activity and report the domain to relevant security teams or threat intelligence platforms. Avoid interacting with any communications or links associated with this domain, as follow-up attacks may occur.