xrpreward[.]xyz

The domain xrpreward.xyz was registered on 24 September 2025 through PDR Ltd. d/b/a PublicDomainRegistry.com. It resolves to the Cloudflare address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. in the United States. The site presented the page title “XRP Airdrop | F-Chain”, indicating a fake cryptocurrency airdrop campaign. The SSL certificate in use is issued by Google Trust Services (WE1), and the authoritative nameservers are brianna.ns.cloudflare.com and jasper.ns.cloudflare.com. The malicious content is identified as the “Airdrop Scam” phishing kit, and the scam type is classified as a Fake Airdrop.

Gridinsoft assigned a trust score of 0 out of 100, reflecting a high confidence in malicious intent. VirusTotal recorded a single positive detection out of 91 scanned vendors, confirming that at least one security product flagged the domain. The domain appears on one external security blocklist and has been listed as blocked by PhishDestroy. The current HTTP status is offline, suggesting the hosting has been taken down or the site is no longer serving content.

The elevated risk rating reflects the combination of a newly created domain, use of a trusted SSL certificate to increase credibility, and the presence of a known phishing kit targeting cryptocurrency investors. Although the site is currently offline, the infrastructure—especially the Cloudflare IP and the two Cloudflare nameservers—remains reusable for future campaigns. Defenders should add xrpreward.xyz to inbound and outbound filtering rules, block the IP 188.114.97.3 and the associated nameservers, monitor Cloudflare‑hosted ranges for similar activity, and watch for other domains that share the same nameserver pair or use the Airdrop Scam kit. Logging of DNS queries for xrpreward.xyz and related sub‑domains is recommended to detect possible re‑use, and continuous threat‑intel feeds should be consulted for any re‑activation of the domain.