# PhishDestroy threat dossier — tripskan.xyz ================================================================ Fetched: 2026-04-27 13:06:24 UTC Canonical: https://phishdestroy.io/domain/tripskan.xyz/ ## VERDICT ---------------------------------------------------------------- ACTIVE + CLOAKED — returns HTTP 666 to scanners, real fraudulent site to victims Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) Cloaking: DETECTED — domain returns custom HTTP 666 to scanners while serving fraudulent content to real users (type: content_divergence) (score: 2/6) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 0/95 security vendors flagged this domain ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 188.114.97.3 Registrar: NICENIC INTERNATIONAL GROUP CO., LIMITED !!! REGISTRAR INTEGRITY ALERT — NiceNIC !!! NiceNIC International: over 90% of its registered domains are associated with illegal content; documented systematic abuse-report non-response. Primary sources: https://phishdestroy.io/nicenic-real https://phishdestroy.io/nicenic-verdict Nameservers: guss.ns.cloudflare.com, lindsey.ns.cloudflare.com Registered: 2026-04-22 HTTP response: 403 ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-04-22 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-04-27 10:53:59 UTC (by PhishDestroy tracker) First reported: 2026-04-27 07:56:24 UTC (abuse notice filed) Last verified: 2026-04-27 13:40:03 UTC Current status: ACTIVE — cloaked behind HTTP 666 to evade scanners ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019dcdec-aa2d-7499-a185-38ba211b7152/ URLQuery: https://urlquery.net/report/71247db9-03b8-4a3c-b182-afff22cdab29 Wayback Machine: https://web.archive.org/web/*/tripskan.xyz crt.sh CT logs: https://crt.sh/?q=%25.tripskan.xyz Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=tripskan.xyz AlienVault OTX: https://otx.alienvault.com/indicator/domain/tripskan.xyz URLhaus: https://urlhaus.abuse.ch/host/tripskan.xyz/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-04-27 10:54:59 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] tripskan.xyz is currently under investigation as an active travel scam phishing domain, indicating an imminent threat to unsuspecting users seeking trip-related services. This domain is engineered to deceive visitors into divulging personal and financial information under the guise of booking travel arrangements, reservations, or vacation packages. The risk level is classified as active, meaning the site is likely operational and distributing malicious links or content to potential victims globally. This domain exhibits multiple red flags consistent with fraudulent activity. Registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on April 22, 2026, tripskan.xyz operates on IP address 188.114.97.3 and holds a valid Let's Encrypt SSL certificate, which may be leveraged to appear trustworthy. Despite no current detection on VirusTotal (0/95 engines), the domain remains untrusted due to the absence of a legitimate operational history, suspicious naming pattern, and the presence of active phishing artifacts. The IP 188.114.97.3 is associated with known malicious infrastructure, further increasing the risk profile. With zero detections despite active distribution, this domain exemplifies a sophisticated, low-profile threat that evades conventional detection mechanisms through rapid deployment and cloaking techniques. To mitigate exposure to this travel scam phishing site, users must refrain from visiting tripskan.xyz or clicking any links from unsolicited emails, ads, or social media posts promoting travel deals. Enterprises and security teams should immediately block traffic to IP 188.114.97.3 and domain tripskan.xyz at the network firewall, DNS, and proxy levels. Domain-based filtering rules should be updated to include NICENIC INTERNATIONAL GROUP CO., LIMITED registrants, particularly domains registered after April 2026. Incident response teams are advised to monitor for endpoint indicators such as SSL certificate 188.114.97.3/Let's Encrypt and flag any user submissions involving travel-related data entry to tripskan.xyz. Proactive threat intelligence sharing and DNS sinkholing of newly registered domains with similar naming patterns are strongly recommended to prevent widespread compromise. ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260427-272D75 Favicon MD5: ea199d973a3403b0d26d5f1674494a88 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/tripskan.xyz/ JSON API: https://api.destroy.tools/v1/check?domain=tripskan.xyz Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 131,000+ phishing domains. Confirmed takedowns: 91,000+. Site: https://phishdestroy.io