viphopes[.]cc

Analysis indicates that viphopes.cc was registered on August 12, 2025 through NameSilo, LLC and is hosted on Cloudflare infrastructure (AS13335, United States) at IP 172.67.138.15. The domain uses Cloudflare’s default nameservers iris.ns.cloudflare.com and lochlan.ns.cloudflare.com and does not present an SSL certificate. The HTTP service is currently offline, but historical records show the site delivered a page titled “TK-Store | buy, sell and discover on TK”, which aligns with the reported scam type of brand impersonation targeting the generic “across” brand category.

Threat intelligence flags confirm malicious intent: 12 of 95 VirusTotal scanners flagged the domain, it appears on one public blocklist, and it has been referenced in fifteen AlienVault OTX pulses. PhishDestroy has already blocked the domain, and Gridinsoft assigns a trust score of 0 out of 100, indicating extreme risk. The lack of SSL and the use of a generic storefront title suggest the site was designed to lure victims into a perceived legitimate marketplace, but no additional page content has been captured.

Defenders should add the domain to outbound filtering rules, monitor the associated IP for any resurgence of activity, and consider extending blocklists to include the observed Cloudflare nameservers. Continuous re‑evaluation is advised, as the site may be re‑hosted on the same IP or similar Cloudflare‑backed assets. Until further evidence emerges, the domain should be treated as high‑risk brand‑impersonation malware delivery vector.