ribbond[.]top

Analysis of ribbond.top indicates this domain was actively impersonating Ethereum as part of a cryptocurrency scam operation. The domain was registered on February 21, 2026, and resolved to IP address 104.21.45.236, hosted on Cloudflare infrastructure (AS13335) in the United States. The SSL certificate was issued by WE1, a provider commonly observed in low-reputation domains. At the time of assessment, the domain's page title displayed 'Aevo,' which may relate to the scam's operational branding, though the exact content and functionality of the site remain unconfirmed due to its offline status.

Multiple security vendors have flagged ribbond.top as malicious. Scamadviser and Gridinsoft both assigned the domain a trust score of 1 out of 100, reflecting extremely low reputation. The domain appeared on two security blocklists and was blocked by PhishDestroy and ScamSniffer, two services specializing in phishing and scam detection. Ten out of 95 security vendors on VirusTotal detected the domain as malicious, further supporting its classification as a crypto scam.

Infrastructure analysis reveals the domain was taken offline by July 23, 2026, though historical records confirm its prior use in brand impersonation targeting Ethereum users. Defenders should treat any prior interaction with ribbond.top as high-risk exposure to cryptocurrency fraud. Organizations should ensure blocklisting of the domain and associated IP address in security controls, and monitor for any resurgence of similar infrastructure under new domains or IPs. The absence of active content limits further technical analysis, but available evidence strongly supports its prior use in malicious activity.