ripple[.]mn

This domain, ripple.mn, is actively flagged as a credential phishing site targeting users as of July 12, 2026. Analysis indicates the domain was registered on May 4, 2026, and currently resolves to the IP address 188.114.97.3, hosted on infrastructure associated with Cloudflare in Canada. The domain is blocked by at least one security vendor and appears on one security blocklist, with a trust score of 0/100. AlienVault OTX records the domain in a threat intelligence pulse, further corroborating its malicious classification. The SSL certificate is issued by Google Trust Services (WE1), which is consistent with legitimate domains but does not mitigate the phishing risk. The HTTP response code is 403, and the page title 'Just a moment...' suggests the site may be using Cloudflare protection or anti-bot measures to evade detection or analysis. While 15 of 91 security vendors on VirusTotal flag the domain as malicious, the exact content and targeting (e.g., specific brands or sectors) remain unconfirmed due to the lack of direct access or detailed forensic data. Defenders should treat this domain as high-risk and prioritize blocking it at the DNS or network level. Monitoring for related infrastructure (e.g., shared IPs, certificates, or registrant details) may reveal additional compromised or malicious assets. Given the domain's recent registration and active status, further investigation into its hosting environment and potential ties to broader phishing campaigns is recommended.