rippletck[.]com

This domain, rippletck.com, was registered on April 6, 2026, through CNOBIN INFORMATION TECHNOLOGY LIMITED and remains active as of July 12, 2026. Infrastructure analysis reveals the domain is hosted behind CloudFlare, resolving to the IP address 188.114.96.3, located in Canada. The nameservers, aron.ns.cloudflare.com and nikon.ns.cloudflare.com, further confirm CloudFlare’s involvement in its hosting and DNS management. The domain currently returns an HTTP 403 status, with the page title displaying 'Just a moment...', a common response from CloudFlare’s security challenges or interstitial pages, which may indicate attempts to filter or obscure malicious activity. The domain appears on at least one security blocklist and is flagged by a single security vendor on VirusTotal, suggesting preliminary detection but limited broader confirmation. A trust score of 0 out of 100 from Gridinsoft reinforces its suspicious classification. Additionally, the domain has been documented in one AlienVault OTX threat intelligence pulse, indicating prior observation in malicious contexts. The SSL certificate, issued by Let’s Encrypt (serial E7), does not provide meaningful attribution, as such certificates are commonly used across both legitimate and malicious infrastructure. While the domain exhibits characteristics consistent with phishing activity, the lack of widespread detection across security vendors leaves some uncertainty regarding its specific targeting or campaign association. The use of CloudFlare may serve to obfuscate the true origin or purpose of the domain, complicating attribution efforts. Defenders should treat this domain as high-risk and consider blocking or monitoring traffic to and from it, particularly in environments where phishing mitigation is a priority. Further investigation into related domains or IPs may reveal additional infrastructure linked to the same threat actor or campaign.