xrplrainforests-rlusd[.]com

This domain is flagged as a credential harvesting and token allocation scam targeting users of the Ripple (XRP) ecosystem. The site, xrplrainforests-rlusd.com, presents itself as an official "XRPLRainforest × Ripple — RLUSD Priority Allocation" portal, falsely claiming to offer early or exclusive access to Ripple’s RLUSD stablecoin. Analysis indicates the site is designed to deceive victims into submitting wallet credentials, private keys, or personal identification details under the guise of a limited-time investment opportunity. The fraudulent nature is reinforced by the use of Ripple’s branding, including logos, color schemes, and terminology associated with legitimate Ripple initiatives, such as the XRPL (XRP Ledger) and RLUSD token distribution events. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on June 06, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with phishing and fraudulent domains. Security vendors on VirusTotal flagged the domain in 7 out of 95 scans, while it appears on 2 independent security blocklists. The site resolves to IP address 188.114.97.3, a Cloudflare-protected endpoint, and employs HTTP/3 and HSTS to mimic legitimate financial platforms. Additionally, the domain is referenced in 1 threat intelligence pulse on AlienVault OTX, further corroborating its malicious classification. The SSL certificate, issued by Google Trust Services, does not mitigate the risk, as phishing sites commonly use valid certificates to appear trustworthy. Users who visited xrplrainforests-rlusd.com should assume their credentials or wallet information may have been compromised. Immediate actions include revoking any connected wallet permissions, transferring assets to a new wallet address, and monitoring transaction histories for unauthorized activity. If personal or financial details were submitted, affected individuals should report the incident to relevant financial institutions and credit monitoring services. System-level scans for malware are recommended, as phishing sites may deploy additional payloads. Organizations should update security policies to block the domain, its resolving IP, and associated indicators of compromise (IOCs) across network defenses. Future vigilance is advised, particularly around Ripple-related promotions or token allocation events, which are frequent targets for impersonation scams.