dripl[.]ink

Analysis of dripl.ink shows that the domain resolves to the AWS‑hosted address 52.85.61.30 and presents an HTTP 302 redirect. The site is served over TLS with an Amazon RSA 2048 M01 certificate issued by Amazon Certificate Manager and includes HSTS headers. Infrastructure inspection reveals the use of Node.js, React, Next.js, Webpack and delivery through Amazon CloudFront, confirming a typical modern web stack hosted on Amazon Web Services. The authoritative name servers are ns-1050.awsdns-03.org, ns-1933.awsdns-49.co.uk, ns-409.awsdns-51.com and ns-519.awsdns, all belonging to the AWS DNS service. The domain was registered on 17 December 2022 via NameCheap, Inc., and the registration has remained unchanged. Public threat intel lists the domain on the PhishDestroy and ScamSniffer blocklists, and it is classified as a brand‑impersonation campaign targeting Stripe. The page title “LinkDrip – The #1 No Code Link Engagement Tool” does not reference Stripe, but the classification indicates that the site is being used to lure victims into believing it is associated with Stripe’s services. VirusTotal scans have resulted in 11 of 95 security vendors flagging the domain as malicious, reinforcing the suspicion. While the observed infrastructure confirms active hosting and a valid TLS configuration, no dynamic content or credential‑harvesting pages have been captured, leaving the exact user‑facing payload unknown. Defenders should block traffic to dripl.ink at the network perimeter, add the domain to URL filtering and email security policies, and monitor for related DNS queries to the listed AWS name servers. Continuous threat‑intel feeds should be consulted for any updates on the payload or phishing kit employed by this campaign.