claim-fuzzyxrp[.]com

Analysis of the domain claim-fuzzyxrp.com indicates it is actively involved in a high-risk cryptocurrency drainer campaign targeting users of the XRP ecosystem. The domain was registered on June 16, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious infrastructure. Current detection metrics reveal that six out of ninety-five security vendors on a widely used threat aggregation platform have flagged the domain as malicious, while it appears on two independent security blocklists. The domain resolves to the IPv6 address 2a06:98c1:3121::3, which has been linked to other fraudulent activities in recent threat intelligence pulses, including fifteen entries in a collaborative threat exchange platform. The page title 'Nur einen Moment…' suggests the use of a cloaking mechanism or intermediate redirect, a common tactic in crypto drainer schemes to evade detection and delay user awareness until wallet interactions occur. The SSL certificate, issued by Google Trust Services, provides a veneer of legitimacy but does not mitigate the underlying threat. Infrastructure analysis reveals no legitimate association with XRP or its official entities, reinforcing the domain’s role in impersonation rather than authorized communication. Defenders should treat this domain as an active threat vector. The combination of a recent registration date, low detection but non-zero vendor flags, and presence on multiple blocklists indicates a targeted campaign that may evade some automated defenses. Network-level blocking of the resolving IP and domain is recommended, alongside monitoring for related subdomains or newly registered lookalike domains under the same registrar. Given the high-risk classification, incident responders should prioritize this domain in investigations involving unauthorized cryptocurrency transactions or reports of XRP-related phishing attempts.