black-ripple[.]com

Analysis of black-ripple.com shows a newly registered domain (creation 28 Oct 2025) that was configured to resolve to the Cloudflare edge address 104.21.1.185 (AS13335, United States). The domain is hosted on Cloudflare DNS (nameservers dora.ns.cloudflare.com and julian.ns.cloudflare.com) and does not present an SSL certificate, causing HTTP requests to return a 522 “Connection timed out” response as reflected in the page title “black-ripple.com | 522: Connection timed out”. The site is listed as a brand‑impersonation campaign targeting XRP and is associated with an “Airdrop Scam” phishing kit. Reputation scoring from Gridinsoft assigns a trust value of 0 / 100, indicating a high confidence of malicious intent. VirusTotal has recorded detections from six of ninety‑five scanned engines, and the domain appears on a single external security blocklist.

PhishDestroy has already taken the site offline, and AlienVault OTX references the domain in one threat‑intel pulse. The risk rating is elevated. Although the site is currently offline, the infrastructure footprint—use of a reputable CDN, lack of TLS, and a generic Cloudflare IP—suggests that the operators may redeploy the domain or clone the infrastructure for future campaigns. No additional content samples, screenshots, or login forms have been captured, leaving the exact visual impersonation tactics unknown.

Defenders should continue to block the domain at DNS and proxy layers, monitor the associated IP address for re‑activation, and add the domain to internal IOC repositories. Continuous re‑scanning on VirusTotal and other multi‑engine services is advised to capture any new detections. Correlation with other observed XRP‑related phishing attempts may reveal shared command‑and‑control resources or kit reuse. Maintaining awareness of the Airdrop Scam template can help analysts prioritize alerts that reference similar lure language.