rlxgifts[.]xyz

PhishDestroy identifies rlxgifts.xyz as an active generic-phishing domain impersonating legitimate reward-survey lures to harvest credentials and payment data. The operation is currently under investigation but remains accessible while flying under 19/95 VirusTotal detections, indicating minimal signature coverage as of the latest scan on seed 761778.

Technical indicators confirm the domain was created on April 05, 2026 through Dynadot LLC and resolves to IPv4 91.218.49.169, which hosts a Let’s Encrypt SSL certificate. With zero detections across 95 engines and no entries in public blocklists, the site’s trust score remains dangerously high for unsuspecting victims. The domain’s recent creation and clean record strongly suggest a newly stood-up campaign designed to exploit freshly registered infrastructure before reputation filters catch up.

To mitigate exposure, users should block 91.218.49.169 at the firewall and refrain from visiting rlxgifts.xyz or any subpages. Enterprises should add the domain and IP to deny lists and configure browsers to block Let’s Encrypt certificates tied to this origin. Consumers must verify reward-survey URLs against official brand domains before entering personal data, and report any interaction to PhishDestroy for rapid takedown.