biddsrewards[.]xyz

The domain biddsrewards.xyz is currently active and engaged in brand impersonation targeting Ledger, a cryptocurrency hardware wallet provider. Analysis indicates this infrastructure is designed to deceive users into interacting with fraudulent NFT marketplace content under the guise of legitimate Ledger services. The specific threat type is confirmed as brand impersonation, with no evidence of direct credential theft or crypto drainer functionality at this time, though such capabilities may emerge as the campaign evolves. Infrastructure analysis reveals the domain was registered on June 24, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious domain registrations. The domain resolves to the IP address 188.114.97.3 and is flagged by 13 of 95 security vendors on VirusTotal. Google Safe Browsing has classified the domain under the SOCIAL_ENGINEERING category, indicating attempts to manipulate users into performing unsafe actions. The SSL certificate is issued by Google Trust Services, which, while providing encryption, does not validate the legitimacy of the site's content or operators. The page title, 'Bidds - Your Leading Coreum & XRP Ledger NFT Marketplace,' explicitly references XRP Ledger, further aligning the deception with cryptocurrency-related fraud. As of the latest assessment, biddsrewards.xyz remains active and poses a high risk to users. Organizations and individuals are advised to block the domain and its associated IP address at the network level. Users should be educated on recognizing brand impersonation tactics, particularly those involving cryptocurrency services. Monitoring for additional domains registered under the same registrar or resolving to the same IP address is recommended to identify related infrastructure. If interaction with the domain has occurred, affected parties should assume potential exposure and conduct a security review of connected accounts and devices.