korea-ripple[.]net

This domain is flagged as a high-risk brand impersonation threat targeting Celer Network, a blockchain interoperability protocol. The site presents itself as hosting a 'BIGGEST EVENT | 2026,' a common tactic in cryptocurrency phishing campaigns to lure victims with promises of rewards or exclusive opportunities. Analysis indicates the domain is designed to deceive users into divulging sensitive credentials, such as wallet private keys or login information, under the pretense of participation in a legitimate event.

Infrastructure analysis reveals the domain korea-ripple.net was registered on February 21, 2026, through Global Domain Group LLC, a registrar frequently associated with malicious domains. It resolves to the IP address 188.114.96.3, hosted on Cloudflare’s network (AS13335), which is often leveraged to obfuscate the true origin of phishing infrastructure. The domain is flagged by 19 out of 95 security vendors on VirusTotal, with detections including phishing and brand impersonation. Google Safe Browsing has explicitly labeled it as phishing, and it appears on at least one security blocklist. The SSL certificate is issued by Google Trust Services (WE1), which, while legitimate, does not mitigate the domain’s malicious intent. Additionally, the domain is blocked by PhishDestroy, further corroborating its classification as a threat.

To mitigate risks associated with this domain, users should avoid interacting with korea-ripple.net and any associated links. Organizations should implement network-level blocking for the domain and its resolving IP address (188.114.96.3) to prevent access. End-users are advised to verify the authenticity of any event or promotion directly through Celer Network’s official channels, such as their verified website or social media profiles. Wallet holders should never enter private keys or seed phrases on untrusted sites, and multi-factor authentication should be enabled for all cryptocurrency-related accounts. Security teams are encouraged to monitor for similar domains registered through Global Domain Group LLC or resolving to Cloudflare IPs, as these may indicate additional phishing infrastructure.