xrp-celebration[.]net

The domain xrp-celebration.net was registered on September 04, 2025 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently taken offline. Infrastructure analysis shows it resolves to the IP address 172.67.131.186, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site presented a page titled "Brad Garlinghouse 100,000,000 #XRP Reward Program," explicitly impersonating Binance and positioning the campaign as a crypto‑related giveaway. The domain appears on a single security blocklist and is blocked by PhishDestroy.

Independent reputation scoring from Gridinsoft assigned a trust score of 0 out of 100, indicating a high likelihood of malicious activity. VirusTotal scans returned a detection by seven of ninety‑three security vendors, reinforcing the suspicion of abuse. The SSL certificate associated with the site is identified only as "WE1," providing no additional authentication of legitimacy.

The overall threat profile aligns with a brand impersonation scheme targeting Binance users, leveraging the high‑profile name of Brad Garlinghouse to lure victims into a purported XRP reward program. While the site is no longer reachable, defenders should continue to block the domain at network perimeters, update URL filtering and DNS threat feeds to include xrp-celebration.net, and monitor for any future re‑hosting attempts that may use the same IP range or certificate attributes. Ongoing vigilance is advised, especially for email or social‑media campaigns referencing Binance or large XRP giveaways, as the actors behind this infrastructure may replicate the tactic with new domains.