xertra[.]app

The domain xertra.app was registered on May 18, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to the IP address 188.114.96.3, which is hosted by Cloudflare, Inc. in Canada. The site presents a valid TLS certificate issued by Let’s Encrypt (E7) and is served from the Cloudflare nameservers camilo.ns.cloudflare.com and serena.ns.cloudflare.com. An HTTP request returns status code 200, indicating the web server is actively delivering content.

The landing page is titled “$STRAX Airdrop” and matches the known “Airdrop Scam” phishing kit. The page mimics a cryptocurrency airdrop offer, attempting to harvest credentials from visitors. The domain appears in a single AlienVault OTX pulse and is listed on one public blocklist. PhishDestroy has already blocked the domain, and the Gridinsoft trust score is 0 out of 100, reflecting a lack of reputation.

Infrastructure analysis shows the use of Cloudflare’s reverse‑proxy service, which conceals the origin server and can complicate takedown efforts. No additional IP addresses or sub‑domains have been observed, and the site currently registers zero detections on VirusTotal out of 95 scans, which does not imply safety but highlights that the content has not yet been flagged by automated scanners. The lack of external references limits the ability to attribute the operation to a specific actor.

Defenders should treat xertra.app as a high‑confidence malicious site. Immediate mitigation steps include adding the domain to URL filtering and DNS block lists, monitoring for similar airdrop‑related page titles, and enforcing TLS inspection to detect the Let’s Encrypt certificate fingerprint. Continuous observation of the associated IP 188.114.96.3 is advised, as changes in the hosting configuration could indicate a shift in the threat actor’s infrastructure.