on-ripple[.]org

This domain, on-ripple.org, is flagged for brand impersonation, specifically targeting the XRP brand. The domain appears to be part of a scam operation that attempts to deceive users by mimicking legitimate XRP-related websites. No drainer kits have been identified on this domain, but the threat remains active and significant due to the impersonation of a well-known cryptocurrency.

Infrastructure analysis reveals that on-ripple.org has been flagged by 8 out of 95 security vendors on VirusTotal, indicating a moderate level of detection. The domain is registered through NiceNIC International Group Co., Limited, and resolves to the IP address 188.114.96.3. It lacks an SSL certificate, which is a red flag for secure transactions. The domain was created on February 21, 2026, and appears on 1 security blocklist. This combination of indicators suggests that the domain is likely being used for malicious purposes, particularly to impersonate the XRP brand.

The current status of the domain is active, and it continues to pose a risk to users who may be misled by its content. Immediate response actions include blocking the domain at the network level and educating users about the dangers of visiting unsecured websites that impersonate well-known brands. Despite these measures, the remaining risk is elevated due to the potential for phishing attacks and other fraudulent activities. Users are advised to avoid interacting with this domain and to report any suspicious activities to their security teams.