eventripple[.]net

Analysis of the domain eventripple.net indicates it is an active credential phishing operation as of July 12, 2026. The domain was registered on May 2, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. Infrastructure analysis reveals the domain resolves to the IP address 188.114.96.3, which is hosted on Cloudflare’s network in Canada, a common tactic to obscure the true origin of malicious infrastructure. The domain’s nameservers, dane.ns.cloudflare.com and molly.ns.cloudflare.com, further confirm Cloudflare’s involvement in its hosting configuration. The domain is currently flagged by multiple security mechanisms, including PhishDestroy, ScamSniffer, and Enkrypt, and appears on three distinct security blocklists. Google Safe Browsing has classified the domain under the category SOCIAL_ENGINEERING, consistent with credential phishing activity. AlienVault OTX records show the domain has been included in 16 threat intelligence pulses, suggesting it has been observed in multiple malicious campaigns. The SSL certificate, issued by Let’s Encrypt (serial number E7), is valid but does not mitigate the domain’s malicious intent, as phishing sites frequently use legitimate certificates to appear trustworthy. At the time of analysis, the domain returns an HTTP 403 status with the page title 'Just a moment...', which is often indicative of Cloudflare’s interstitial pages or a placeholder before redirecting victims to a phishing landing page. The exact content of the phishing page is not yet analysed, but the domain’s classification as a credential phishing site aligns with its observed infrastructure and detection patterns. Defenders should treat this domain as high-risk and block access at the network level. Further monitoring is recommended to identify any shifts in its hosting or additional indicators of compromise.