xrparmytokenportal[.]com

Analysis of xrparmytokenportal.com, created on February 21 2026 and currently flagged as high‑risk, shows multiple indicators of malicious activity. The domain is registered through NiceNIC International Group Co., Limited and is served by Cloudflare nameservers hadlee.ns.cloudflare.com and ian.ns.cloudflare.com. DNS resolution points to IP 188.114.97.3, an address owned by AS13335 Cloudflare, Inc. in the United States. The site presents an HTTP 403 status and returns the page title "Just a moment...", which is consistent with prior observations of phishing portals that employ Cloudflare Browser Insights and HTTP/3.

The SSL certificate is issued by Google Trust Services under the WE1 root, a legitimate certificate authority, but its presence does not mitigate the underlying threat. Reputation services show a Gridinsoft trust score of 0 / 100, and the domain is listed on at least one security blocklist. PhishDestroy has already blocked the domain, and VirusTotal records three detections out of ninety‑three scanned security vendors, confirming that a subset of AV engines consider the site malicious. The overall classification is "generic phishing" with a specific "crypto scam" label, indicating that threat actors likely aim to harvest cryptocurrency‑related credentials.

What remains uncertain is the exact payload or credential‑stealing mechanism, as no detailed page content beyond the title has been disclosed. Defenders should continue to block traffic to the domain, monitor DNS queries for the associated IP address, and update intrusion detection signatures with the observed hostnames and IP. Organizations handling cryptocurrency accounts should enforce multi‑factor authentication and educate users about unsolicited portals that display generic titles such as "Just a moment...". Continuous re‑evaluation of the domain’s status is advised, given its active classification and recent creation date.