ripple26[.]com

The domain ripple26.com was registered on April 10, 2026 through Dominet (HK) Limited. The site resolves to the Cloudflare‑hosted address 104.21.38.150 and uses the nameservers drake.ns.cloudflare.com and stella.ns.cloudflare.com. The SSL certificate is issued by Google Trust Services (WE1) and the page currently returns HTTP 403 with the title “Just a moment…”. The site is flagged by multiple blocklists, including PhishDestroy, MetaMask, and SEAL, and appears on three security blocklists overall.

Infrastructure analysis shows the hosting IP is located in Canada and is associated with Cloudflare’s edge network, which provides HTTP/3 and Cloudflare Browser Insights. The domain’s trust score from a known reputation engine is 0 / 100, indicating a lack of legitimate reputation. The host is listed in one AlienVault OTX pulse and Google Safe Browsing classifies the URL as a social‑engineering threat.

Detection telemetry indicates that only one of ninety‑five VirusTotal scanners raised a flag, suggesting limited detection coverage rather than confirmation of benign behavior. The HTTP 403 response suggests the site may be employing a challenge page, but the presence of a generic “Just a moment…” title is consistent with typical phishing landing pages that rely on JavaScript redirects. The active status and recent creation date imply a short‑lived campaign, yet the continued presence on blocklists confirms ongoing malicious use.

Defenders should block ripple26.com at the network perimeter and update endpoint protection signatures to include the domain. Monitoring for connections to 104.21.38.150 and the associated Cloudflare nameservers can help identify compromised clients attempting to retrieve the malicious page. Users should be warned that any unsolicited request for credentials or personal information from this domain is likely fraudulent, and any such interactions should be reported to the appropriate security team.