xrpfi-hub-flare[.]com

xrpfi-hub-flare.com was registered on May 29, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED. The domain resolves to 172.67.171.122, an address owned by Cloudflare, Inc. (AS13335) and uses the Cloudflare nameservers jen.ns.cloudflare.com and todd.ns.cloudflare.com. The TLS certificate is issued by Let’s Encrypt and is currently valid, indicating that the operator is leveraging a free certificate authority to establish encrypted connections.

A request to the root URL returns HTTP status code 403 and the page title “Just a moment…”. The presence of a 403 response together with a generic waiting title is consistent with a content delivery network challenge that is often employed to hide malicious payloads until a victim’s browser satisfies certain conditions. The site also advertises HTTP/3 support, confirming recent protocol adoption.

Threat intelligence classifies the site as a generic phishing host. Six of ninety‑five VirusTotal scanners flagged the domain as malicious, and the domain appears on three external blocklists. Independent blocklists from PhishDestroy, MetaMask, and SEAL have already listed the address, and the Gridinsoft trust score is 0 out of 100, reflecting a high confidence of malicious intent. The combination of a newly created domain, a Cloudflare front‑end, and a low trust score aligns with the high‑risk rating assigned by analysts.

Defenders should block traffic to xrpfi-hub-flare.com at the DNS and network layers and monitor for any outbound connections to the associated IP address. Because the site uses a legitimate TLS certificate, inspection of HTTPS traffic via a forward proxy or SSL decryption appliance is advisable to reveal any hidden payloads. Continuous re‑evaluation is recommended, as the threat actor may alter the underlying content while retaining the same infrastructure.