xrp[.]emmn[.]io

This report analyzes the domain xrp.emmn.io, which was identified as a threat during routine monitoring. The site presented itself with the page title "Crypto Airdrop" and was designed to impersonate the brand Metamask, categorizing it as a cryptocurrency scam. The primary threat posed by this domain was its use as a phishing or fraudulent airdrop lure, attempting to deceive users into connecting their cryptocurrency wallets or providing sensitive credentials under the guise of a legitimate Metamask airdrop.

Technical analysis provides concrete evidence of the domain's malicious nature. VirusTotal flagged the domain with 3 detections out of 95 scanners, with specific flags from CRDF, Gridinsoft, and SOCRadar. The domain is hosted on one blocklist. It was registered on 2026-02-21 and resolves to IP address 191.96.56.44, located in the United States, under the autonomous system AS47583 operated by Hostinger International Limited. The site utilized an R13 SSL certificate, and Gridinsoft assigned it a trust rating of 0 out of 100.

As of the time of this report, the domain xrp.emmn.io is in a DOWN or OFFLINE status. Despite being inactive, it carries a high DOM risk score of 71 out of 100, indicating a significant residual threat. The combination of its recent creation date, low trust rating, and specific security vendor flags underscores its high-risk classification for cryptocurrency-related scams.