reftniblockchain[.]xyz

The domain reftniblockchain.xyz was registered on February 21, 2026 through the HOSTINGER operations, UAB registrar. It resolves to the IPv4 address 92.113.16.82, which is announced by AS47583 belonging to Hostinger International Limited and geolocated to Germany. The site presents the page title “Rectification” and serves an SSL certificate identified as WR1. Gridinsoft assigns a trust score of 0 out of 100, indicating a lack of reputation.

Threat intelligence classifies the activity as a fake airdrop used for brand impersonation across an unspecified target brand. The domain appears on four security blocklists – PhishDestroy, Polkadot, Enkrypt, and Codeesura – and VirusTotal records 12 positive detections out of 93 scanned vendors. The overall risk rating is high, and the current operational status is offline, suggesting the infrastructure has been taken down or is no longer serving content. Analysis of the available indicators suggests that the infrastructure was deliberately provisioned to host a cryptocurrency‑themed scam, leveraging the “airdrop” narrative to lure victims.

The combination of a newly created domain, a zero‑trust score, multiple blocklist listings, and a non‑zero VirusTotal detection count provides strong evidence of malicious intent. Defenders should continue to block the domain at network perimeters, update DNS filtering policies to include the listed blocklists, and monitor for any resurgence of the same IP address or related Hostinger‑owned ranges. Because the domain is already offline, incident response teams can focus on detecting any residual phishing emails or payloads that reference reftniblockchain.xyz, and consider sinkholing the IP to disrupt any future re‑use. Ongoing observation of the registrar’s newly issued domains may reveal additional campaigns employing similar tactics.