xrpl-flare[.]foundation

This domain, xrpl-flare.foundation, operates as a fraudulent cryptocurrency airdrop portal targeting XRP token holders. The site presents itself as an official Flare Network distribution platform, tricking visitors into connecting wallets to claim non-existent rewards. Once connected, the site executes a crypto drainer script that siphons funds from the victim's wallet without authorization. The scheme specifically targets users familiar with XRP and Flare token distributions, exploiting trust in legitimate airdrop campaigns. Analysis indicates this is a sophisticated phishing operation with multiple technical red flags. The domain was registered on May 13, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com, an uncommon registrar for legitimate crypto projects. VirusTotal shows 5 out of 95 security vendors flagging the domain as malicious, including detections for phishing and crypto-related fraud. The site resolves to 104.21.48.249, a Cloudflare IP address, and appears on three separate security blocklists. The Let's Encrypt SSL certificate (E8) provides HTTPS encryption, creating a false sense of security while the underlying site remains malicious. If you visited xrpl-flare.foundation or connected a wallet to this site, immediate action is required. First, disconnect the wallet from all dApps and revoke any suspicious token approvals using a blockchain explorer. Next, transfer all remaining assets to a new wallet with fresh private keys. Monitor all connected accounts for unauthorized transactions, as the drainer script may have lingering access. Report the incident to your wallet provider and relevant blockchain security teams. Never reuse passwords or seed phrases from compromised wallets, and consider installing a dedicated security extension to block known malicious domains.