clipr[.]cc

Analysis of clipr.cc shows a high‑risk Facebook brand impersonation campaign hosted on a Cloudflare edge IP (104.21.48.1) located in the United States and routed through AS13335. The domain, created on 30 April 2023 and registered via Hosting Ukraine LLC, presents a generic link‑shortening page titled “Link shortener free ᐉ Clipr.cc”. Infrastructure fingerprints include a Google Trust Services WE1 SSL certificate, HSTS enforcement, Bootstrap front‑end, Google PageSpeed optimisation, Cloudflare Browser Insights and HTTP/3 support, all delivered over a 301 redirect. Reputation services assign a trust score of 1 / 100 on both Gridinsoft and Scamadviser, and the domain appears on a single security blocklist. VirusTotal records nine of ninety‑five scanners flagging the host, while AlienVault OTX references it in one pulse. The site is already blocked by PhishDestroy. Concrete malicious behaviour beyond the branding claim has not been publicly disclosed, leaving the exact payload or credential‑harvesting mechanisms uncertain. Defenders should add clipr.cc to deny‑list rules across DNS, web‑proxy and email filters, monitor Cloudflare‑origin traffic for similar shortener patterns, and consider sharing the indicator set with threat‑sharing communities to improve early detection of related campaigns.