black-ripple[.]com
“black-ripple.com | 522: Connection timed out”
Ringkasan bukti
Analysis of black-ripple.com shows a newly registered domain (creation 28 Oct 2025) that was configured to resolve to the Cloudflare edge address 104.21.1.185 (AS13335, United States). The domain is hosted on Cloudflare DNS (nameservers dora.ns.cloudflare.com and julian.ns.cloudflare.com) and does not present an SSL certificate, causing HTTP requests to return a 522 “Connection timed out” response as reflected in the page title “black-ripple.com | 522: Connection timed out”. The site is listed as a brand‑impersonation campaign targeting XRP and is associated with an “Airdrop Scam” phishing kit. Reputation scoring from Gridinsoft assigns a trust value of 0 / 100, indicating a high confidence of malicious intent. VirusTotal has recorded detections from six of ninety‑five scanned engines, and the domain appears on a single external security blocklist.
PhishDestroy has already taken the site offline, and AlienVault OTX references the domain in one threat‑intel pulse. The risk rating is elevated. Although the site is currently offline, the infrastructure footprint—use of a reputable CDN, lack of TLS, and a generic Cloudflare IP—suggests that the operators may redeploy the domain or clone the infrastructure for future campaigns. No additional content samples, screenshots, or login forms have been captured, leaving the exact visual impersonation tactics unknown.
Defenders should continue to block the domain at DNS and proxy layers, monitor the associated IP address for re‑activation, and add the domain to internal IOC repositories. Continuous re‑scanning on VirusTotal and other multi‑engine services is advised to capture any new detections. Correlation with other observed XRP‑related phishing attempts may reveal shared command‑and‑control resources or kit reuse. Maintaining awareness of the Airdrop Scam template can help analysts prioritize alerts that reference similar lure language.
Data Coverage
Alur Tanggapan Ancaman Pipeline
Cakupan daftar blokir
10 sumber eksternal dipantau · snapshot tersimpan 11/08/2026
Linimasa deteksi
-
Cloudflare Radar
Pemindaian Cloudflare Radar tersimpan · Buka pemindaian
Tangkapan tersimpan
Intelijen Domain
Detail teknisDNS, nama TLS, dan stempel waktu
ICANN OVERSIGHT
Akreditasi dan konteks RAA
Akreditasi dan konteks RAA
Registrar accreditation and DNS abuse obligations
For this gTLD, the registrar above operates under an ICANN accreditation agreement. The links below provide the official fee schedule and current DNS abuse compliance guidance.
Accreditation is a contract, not a safety certification.
RAA §3.18 establishes abuse-contact and handling requirements. This report can document stored outbound notices and later technical observations; it does not by itself establish receipt, investigation, remediation, or contractual non-compliance.
Analisis VirusTotal
Apakah Anda Terpengaruh oleh Situs Ini?
Jika Anda memasukkan kredensial akun, informasi pribadi atau pembayaran, atau mengunduh file dari domain ini, segera ambil tindakan. Di bawah ini adalah sumber daya untuk membantu Anda melaporkan insiden tersebut dan melindungi diri Anda sendiri.
Laporkan kepada Pihak Berwenang di Daerah Anda
Pilih negara Anda untuk mendapatkan kontak resmi kejahatan dunia maya, atau membuat draf pengaduan →.
Periksa Domain Apa Pun
Analisis ancaman menggunakan daftar blokir yang disimpan, WHOIS, DNS, dan bukti pemindaian publik
Pindai SekarangLaporkan Phishing
Laporkan domain yang mencurigakan ke basis data ancaman kami — lindungi komunitas
LaporanPemberitahuan Ancaman Real-Time
Laporan phishing terbaru dan perubahan ketersediaan yang diamati
PantauTetap Terinformasi, Tetap Aman
Pantau ancaman secara langsung atau ajukan keberatan terhadap daftar ini jika Anda yakin ini merupakan false positive