allocation-xrpl[.]org

Analysis indicates that allocation-xrpl.org was registered on 21 February 2026 through NiceNIC International Group Co., Limited and resolves to the Cloudflare address 188.114.97.3 (AS13335, United States). The domain is currently taken offline, but historical records show it served a page titled “The Biggest XRP Airdrop”. The page title, together with the classification of the kit as “Airdrop Scam”, points to a cryptocurrency‑focused impersonation campaign that targets the Ledger brand. The site was listed on a security blocklist, flagged by Google Safe Browsing for social engineering, and appears in one AlienVault OTX pulse. VirusTotal scans returned eight positive detections out of ninety‑three submitted samples, confirming that multiple anti‑malware engines consider the domain malicious.

Cloudflare nameservers ara.ns.cloudflare.com and wilson.ns.cloudflare.com were observed, and no TLS certificate was presented, indicating that the site operated over plain HTTP. Gridinsoft assigned a trust score of zero out of one hundred, reinforcing the low credibility assessment. PhishDestroy has actively blocked the domain. The combination of a brand‑specific impersonation tag, the airdrop‑related kit, and the presence of multiple independent detections suggests a coordinated attempt to lure Ledger users into a crypto‑airdrop scam.

Uncertainty remains regarding the current activity of the infrastructure, as the domain is offline and no recent HTTP response can be observed. Defenders should add the domain to internal blocklists, monitor the associated IP address for any re‑use, and enforce strict outbound filtering for URLs containing “airdrop” or references to Ledger. Email gateways should be tuned to flag messages that reference “XRP airdrop” or similar phrasing, especially when paired with Ledger branding.