xrpgetkorea[.]com

Analysis of xrpgetkorea.com indicates a newly registered domain created on 21 Feb 2026 that was used to impersonate Binance in a crypto-related scam. The site presented the Korean page title “암호화폐 업계 사상 최고의 이벤트”, which translates to “the greatest event in the cryptocurrency industry”, suggesting a lure aimed at Korean‑speaking users. The domain resolves to 172.67.181.83, an address owned by Cloudflare (ASN 13335) located in the United States, and uses the Cloudflare nameservers nick.ns.cloudflare.com and saanvi.ns.cloudflare.com. No TLS certificate was observed, meaning the site served HTTP only. Reputation services have flagged the domain: PhishDestroy listed it as blocked, and it appears on one security blocklist.

VirusTotal scanned the site and 15 of 95 antivirus or URL‑reputation engines returned a positive detection, confirming malicious activity. Gridinsoft assigned a trust score of 0/100, and the registrar information shows registration through Eranet International Limited, a provider commonly used for disposable domains. The domain is currently taken offline, and the threat classification is recorded as a “Crypto Scam” that impersonates Binance. Uncertainties remain regarding the exact content served before takedown; no page snapshot or HTTP response codes are available, and the site’s behavior after the initial landing page cannot be verified.

No SSL/TLS fingerprint or certificate details exist, limiting cryptographic analysis. Defenders should add 172.67.181.83 to network‑level blocklists, monitor for other domains that resolve to the same Cloudflare IP range and use the same nameservers, and ensure that any inbound traffic to xrpgetkorea.com is denied. Security teams should also update brand‑impersonation filters for Binance to include the observed Korean page title and the domain registration pattern observed here. Continuous re‑scanning of the domain through multi‑engine services is advised in case the site re‑appears under a different host.