voltrwa-allocation[.]com

Analysis on voltrwa-allocation.com (registered 10 Sep 2025 via NiceNIC International Group Co., Limited) shows a deliberately crafted site that claims to present “$XVM – VOLT | Supercharging the Next Generation of RWA on XRP”. The page title is the only publicly observable content; no SSL certificate is provisioned, indicating the site was served over plain HTTP. Infrastructure resides behind Cloudflare (ASN 13335) with the domain resolving to 172.67.136.252, an IP address located in the United States. The domain uses the Cloudflare‑provided nameservers benedict.ns.cloudflare.com and melina.ns.cloudflare.com, a typical pattern for fast‑flux or abuse‑friendly hosting. Reputation signals are uniformly negative.

Gridinsoft assigns a trust score of 0 / 100, and the domain appears on two independent blocklists, PhishDestroy and ScamSniffer, both of which have catalogued it as a wallet/seed phishing operation targeting the DexScreener brand. VirusTotal analysis records three detections out of ninety‑five scanners, reinforcing the malicious classification. The site is currently offline, which may be the result of takedown actions or automated sink‑holeing by security vendors. Evidence confirms the domain’s primary objective is brand impersonation of DexScreener, likely intended to harvest cryptocurrency wallet seeds.

No additional artifacts such as malicious payloads, credential‑stealing forms, or redirect chains have been observed, leaving the exact phishing flow uncertain. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurgence of the same host header or IP address, and update endpoint and email filters with the observed indicators. Organizations that use DexScreener should educate users about the absence of TLS, the mismatched page title, and the risk of unsolicited requests for wallet seeds. Ongoing vigilance is advised, as the underlying Cloudflare infrastructure may be reused for future impersonation campaigns.