soilxrpl[.]com

The domain soilxrpl.com was registered on June 25, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently resolving to the Cloudflare‑hosted address 188.114.97.3 (AS13335, United States). The site presents the page title “SOIL Protocol — SEED Allocation & RLUSD Incentive Portal” and serves over HTTPS with a Google Trust Services / WE1 certificate, HSTS, and HTTP/3 enabled. Technical fingerprinting shows a Google Web Server front‑end. The domain has a Gridinsoft trust score of 0/100 and appears on two security blocklists, specifically PhishDestroy and ScamSniffer. AlienVault OTX references the domain in two separate threat‑intel pulses, and VirusTotal reports a single detection out of 91 scanned engines. The nameservers addilyn.ns.cloudflare.com and kareem.ns.cloudflare.com are both Cloudflare managed. The threat is classified as credential phishing and is assigned a high risk level. While the page content has not been directly observed, the combination of a newly registered domain, low trust score, blocklist listings, and detection by multiple security services indicates an active phishing infrastructure targeting users of the SOIL Protocol ecosystem. Defenders should add soilxrpl.com to URL filtering and DNS blocklists, monitor for any related C2 activity, and consider sinkholing the associated IP address to disrupt traffic. Ongoing observation of the domain’s resolution and any changes in detection status is recommended.