xrpbonus[.]gift

The domain xrpbonus.gift was registered on May 02, 2026 through Key-Systems, LLC and is currently hosted behind Cloudflare’s network (IP 188.114.97.3, located in CA). The authoritative name servers ernest.ns.cloudflare.com and margot.ns.cloudflare.com confirm the use of Cloudflare’s DNS service. An HTTPS endpoint is presented with a Let’s Encrypt certificate (E7) that is valid at the time of analysis, indicating a typical abuse of free TLS provisioning to lend legitimacy to the site. The site returns HTTP status code 403 and displays the page title “Just a moment…”, a pattern often employed to conceal malicious content behind a Cloudflare challenge page.

Threat intelligence sources flag the domain as high‑risk. PhishDestroy has already blocked the site, and it appears on a public blocklist. AlienVault OTX references the domain in one pulse, and VirusTotal reports three positive detections out of ninety‑five scanners. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. These indicators collectively suggest that the infrastructure is being used for credential‑ harvesting or lure campaigns, even though the underlying payload is not directly observable due to the 403 response.

The precise target brand or lure content remains uncertain because the challenge page prevents immediate content inspection. Defenders should therefore treat the domain as a confirmed phishing vector. Immediate mitigation steps include adding xrpbonus.gift and its resolving IP 188.114.97.3 to network blocklists, monitoring DNS queries for the domain, and instituting URL filtering rules that deny access. Continuous threat‑intel monitoring is advised to capture any future changes in the site’s behavior, such as the deployment of a visible phishing page or the adoption of additional hosting assets.