xrp-gives[.]com

The domain xrp-gives.com was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and first observed on April 30, 2026. The registration date places the domain in the current threat landscape, and the registrar is known to host a variety of malicious sites. No further WHOIS fields suggest a legitimate owner, reinforcing suspicion.

Technical resolution shows the domain using the authoritative nameservers savanna.ns.cloudflare.com and vern.ns.cloudflare.com, pointing to the IP address 104.21.66.65 hosted by Cloudflare, Inc. in Canada. The web server presents a Let’s Encrypt certificate (issuer E7) and returns HTTP 403 for default requests, indicating an intentional block or a placeholder page rather than serving content directly.

Detection data corroborate malicious intent. VirusTotal records a single positive detection out of 95 scanners, while three independent blocklists have already listed the domain. AlienVault OTX includes it in one pulse, and Google Safe Browsing classifies the URL under the SOCIAL_ENGINEERING category. The Gridinsoft trust score is 0 / 100, and the domain appears on multiple threat intelligence feeds, all of which align with credential‑harvesting activity.

Analysis concludes that xrp-gives.com is being leveraged for credential‑harvesting campaigns, likely targeting users of cryptocurrency services given the “xrp” keyword. Uncertainty remains about the exact payload or phishing page content because the HTTP response is a 403, which may mask a dynamic delivery mechanism. Defensive teams should block the domain at perimeter firewalls, update URL filtering policies, and monitor DNS queries for the associated IP and nameservers. Incident responders should also watch for related domains registered by the same registrar that share the same infrastructure.