Is ripplepepe.com a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Google, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

ripplepepe.com is a crypto-themed web property whose name combines two well-known digital-asset brand terms. When a visitor reaches it, access is intercepted by a protective interstitial titled "Suspected Phishing" instead of a normal homepage, so the site's own pages disclose no product, service or business model. Its apparent purpose is therefore unestablished, and it currently presents as a high-risk destination.

Scam/Impersonation Risk

Confirmed contradictory signals are present, and the site carries an active blacklist listing. A major browser-safety service classifies it under the social-engineering category, which covers phishing and deceptive sites. A large share of independent security engines also rate it malicious, including several top-tier vendors. Together these detections are decisive, and the site's protective and technical features cannot offset them. No brand impersonation or conflicting legal identities were observed, so the risk rests on the external threat detections and not on identity inconsistency. The site's behaviour during automated sessions raised no wallet-drainer, clipboard-hijack, hidden-form or credential-exfiltration activity, and its outbound traffic went only to recognised destinations. The sessions did show heavy third-party request activity, a high rate of console errors and very large page-structure changes after interaction. That pattern fits a dynamic, script-driven page and is consistent with content that changes after load. The domain name evokes established crypto brands, but no impersonation was confirmed. The site's real content could not be reviewed, because access was met with the warning interstitial. Evidence:

• Homepage: access returned a blocked response carrying a "Suspected Phishing" interstitial, and only a small amount of text was captured.
• Threat intelligence: 17 engines flagged the domain malicious and 2 suspicious, with Fortinet, Google, Kaspersky and Sophos among the flagging vendors. The browser-safety service reported a SOCIAL_ENGINEERING threat type.
• Behavioural sessions: 63 external XHR/fetch calls and 9 external POST requests (none to non-whitelisted destinations), 25 console errors, and up to 1,518 DOM mutations after interaction. No wallet-connect, wallet-drainer or clipboard-write activity was detected.
• Provenance: the web archive holds 7 snapshots spanning 2024–2026 (3 years tracked). The current registration record dates only from 2026-08-22 (~64 days old).

Regulatory Verification Notes

No regulator, licence or corporate registration could be connected to this site, and its on-page disclosure of legal identity is unclear. In this case that gap is secondary to the threat detections and is not offered as separate evidence of wrongdoing. The operator's real-world identity is unverified, and the registration details show ownership opacity. That is an administrative limitation and not an identity contradiction. No third-party broker reputation record matched the domain. The only external reputational information is the security-detection history described above. Evidence:

• Registration: the domain was registered on 2026-08-22 through NICENIC International Group Co., Limited. It expires 2027-08-22, and the current registration is about 0.18 years old.
• Transport security: the TLS certificate was issued by WE1 (DV, domain validation only), is valid to 2027-01-18 and has 84 days remaining. DV validation confirms control of the domain, not the operator's identity.
• Hosting: served from AS13335 (Cloudflare, Inc., US).

What to Verify Next

Verification should begin with whether any legitimate organisation actually operates this domain. It should not involve using the site. The brand terms in the domain name should be checked against the official channels of any token or project they appear to reference, using addresses obtained independently of this site. If a registry or licence claim ever appears on the site, it should be checked directly with the named registry. The site's official support and contact channels should be confirmed through an independent, offline route. The site's listing status should be rechecked with the browser-safety and security-engine providers before any reassessment. Evidence:

• Homepage: the interstitial blocks access, so no on-site identity, licence or contact claims can be tested against an external registry.
• Domain record: the registration is about 64 days old, which gives little operating history against which to judge the site.
• Archive: the 7 snapshots between 2024-03-28 and 2026-08-31 are too few to establish continuity.

Summary Verdict

The site is assessed as a critical-risk destination. Active detections by major security vendors and a browser-safety classification outweigh every neutral or positive technical attribute. The operator's identity is also unverified. The evidence supports a clearly cautionary stance and no endorsement.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and WAF. Every observed address is an edge server, and no origin server was observable. The certificate is valid and the hosting network is a mainstream one, which is a mitigating factor. The domain is young and has sparse subdomain structure, which raises an unconfirmed heuristic concern. Edge-only visibility prevents independent verification of the real hosting. Protective infrastructure is not evidence of legitimacy and cannot offset the reputational findings.

Closing Assessment

The site should not be used for login, credential entry, payments or any financial interaction, and nothing should be downloaded from it. Any visit should be limited to passive viewing, and any credentials already entered should be changed immediately.