ripple-korea[.]com

This report analyzes the domain ripple-korea.com, which was identified as an impersonation threat. The site's page title, "BIGGEST EVENT | 2026," suggests it presented itself as a promotional or event-related page. The domain impersonated the brand "celer" and was classified as an impersonation scam. The primary threat posed by this site was deceiving users into believing it was associated with the legitimate celer brand, potentially to harvest credentials, distribute malware, or facilitate fraudulent transactions.

Technical analysis provides concrete evidence of malicious activity. VirusTotal flagged the domain with 8 detections out of 95 security vendors. It was flagged by five security vendors: alphaMountain.ai, CRDF, CyRadar, Fortinet, and Gridinsoft. The domain was listed on one blocklist. Its IP address, 172.67.174.199, is located in the United States and is associated with AS13335, Cloudflare, Inc. The domain was registered through Global Domain Group LLC and was created on 2026-02-21. It utilized an SSL certificate classified as WE1.

The domain ripple-korea.com is currently down or offline. Its trust rating from GridinSoft is 0 out of 100, and it received a domain risk score of 68. Based on this evidence, the domain represents a high risk, consistent with an active impersonation campaign that has been shut down or taken offline.