ripple-brad[.]org

Analysis indicates that ripple-brad.org is an active brand‑impersonation threat targeting the XRP brand. The domain was registered on 2026‑02‑21 through the Regional Network Information Center, JSC dba RU‑CENTER and is currently resolved to IP address 172.67.184.154, which belongs to Cloudflare (AS13335). Infrastructure details show the site is protected by Cloudflare with HTTP/3 enabled and uses a Google Trust Services / WE1 SSL certificate. DNS resolves to the Cloudflare nameservers arnold.ns.cloudflare.com and erin.ns.cloudflare.com. HTTP responses return a 403 status and the page title reports a "522: Connection timed out" error, suggesting the origin server is either unavailable or deliberately concealed. Google Safe Browsing flags the domain for SOCIAL_ENGINEERING, and VirusTotal records 10 of 93 security vendors flagging the domain as malicious. The Gridinsoft trust score is 0/100, and the domain appears on one security blocklist, with PhishDestroy already blocking it. While the exact content of the site has not been captured, the combination of brand‑impersonation labeling, high‑risk rating, and multiple security detections confirms a credible threat. Defenders should immediately block ripple‑brad.org at the DNS or proxy level, add the IP 172.67.184.154 to outbound block lists, and monitor for any outbound connections to Cloudflare‑hosted assets that may be used to serve malicious payloads. Continuous scanning of the domain with sandbox and URL reputation services is advised, as the underlying payload or phishing page could become active if the origin server is re‑enabled.