xrpceo-25[.]net

This domain operates as a fraudulent cryptocurrency airdrop scheme specifically targeting XRP token holders. The site presents itself as a legitimate distribution of 100,000,000 XRP, exploiting the brand reputation of Ripple and associated cryptocurrency projects to deceive victims into disclosing wallet credentials or transferring funds under false pretenses. The scam leverages urgency and large monetary incentives to bypass user skepticism, a common tactic in cryptocurrency-related fraud campaigns. Analysis indicates the domain was registered on February 21, 2026, through Beget LLC, with infrastructure hosted on Cloudflare IP 104.21.60.74. Security vendor detection on VirusTotal shows 19 out of 95 engines flagging the domain as malicious, while it appears on one security blocklist. The SSL certificate is issued by Google Trust Services (WE1), a common practice among threat actors to mimic legitimate encryption standards. The page title explicitly references a "100,000,000 #XRP Airdrop – Medium," further confirming its fraudulent intent. Users who visited xrpceo-25.net should immediately revoke any wallet permissions granted to the site and transfer assets to a new wallet if credentials were entered. Monitor financial accounts for unauthorized transactions and report the incident to relevant cryptocurrency exchange platforms. Security teams should add the domain and associated IP 104.21.60.74 to network blocklists, while cryptocurrency projects should issue public warnings to their communities about this specific scam variant.