westernunionsf[.]ricohtrac[.]com

Analysis of westernunionsf.ricohtrac.com shows a newly registered domain (created March 22, 2026) that is actively serving content over HTTPS with a Let’s Encrypt certificate (E8). The domain resolves to IP 104.18.22.71, which belongs to Cloudflare, Inc., and is delegated to the Cloudflare name servers aitana.ns.cloudflare.com and nicolas.ns.cloudflare.com. Infrastructure fingerprints include Bootstrap, Split, jQuery, HSTS, Google Analytics, and Cloudflare, all typical of fast‑deployment phishing kits. The page title returned by the server is "Western Union," and the threat classification is listed as Banking Phishing. Gridinsoft assigns a trust score of 0/100, and the domain appears on one external security blocklist while being explicitly blocked by PhishDestroy. VirusTotal scans have flagged the domain by 20 of 94 security vendors, reinforcing the malicious assessment. The site returns HTTP 200, indicating that the phishing payload is currently accessible. While the exact content of the landing page has not been captured, the combination of brand‑targeted page title, low trust score, multiple vendor detections, and active blocklist listings provides strong evidence of a high‑risk phishing operation. Defenders should immediately block DNS resolution for westernunionsf.ricohtrac.com, enforce URL filtering to deny HTTP/HTTPS traffic to the associated IP address, and consider sinkholing the domain to disrupt the campaign. Continuous monitoring of Cloudflare‑hosted IP ranges for similar newly created domains is advised, and any observed credential submissions should be treated as compromised.