589xrpl[.]info

This domain, 589xrpl.info, is identified as a fraudulent airdrop claim portal designed to deceive users into interacting with malicious crypto infrastructure. The site impersonates the legitimate 589onXRPL project, tricking visitors into connecting wallets or entering sensitive credentials under the guise of claiming a token airdrop. Such schemes often deploy crypto drainers, which automatically siphon funds from victims' wallets once permissions are granted. The threat is classified as brand impersonation with an elevated risk level due to its targeted nature and potential for financial loss. Analysis indicates this domain was registered on April 11, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. Security vendors on VirusTotal flagged the domain at a ratio of 5 out of 95, reflecting moderate but concerning detection. The site resolves to the IP address 104.21.74.207 and employs Cloudflare for hosting and DDoS protection, a common tactic to obscure malicious infrastructure. Additional technologies detected include HSTS and HTTP/3, which may lend an air of legitimacy while masking the underlying fraudulent activity. Users who visited 589xrpl.info or interacted with its content should take immediate action to mitigate risk. First, revoke any wallet permissions granted to the domain or associated smart contracts using a blockchain explorer or wallet management tool. Next, scan the device used to access the site for malware, as crypto drainers may deploy secondary payloads. Monitor connected wallets for unauthorized transactions and consider transferring funds to a new, secure wallet if any suspicious activity is detected. Report the domain to relevant security platforms to aid in broader threat intelligence efforts and prevent further victimization.