tripscan-now[.]online

PhishDestroy identifies the domain tripscan-now.online as an active generic phishing threat targeting online travelers. The domain is currently under investigation as part of a broader campaign designed to deceive users into disclosing sensitive personal or financial information under the guise of legitimate travel services.

This domain was flagged by 1 of 95 VirusTotal vendors as of the latest scan, indicating a low detection rate despite its active status. Registered through Registrar of Domain Names REG.RU LLC on March 27, 2026, the domain resolves to IP address 185.130.47.48 and utilizes a Let’s Encrypt SSL certificate to enhance credibility. The domain remains unlisted on major threat intelligence blocklists as of this report, with no recorded trust scores or reputation metrics available at this time. This low detection profile suggests a newly deployed infrastructure likely intended to evade early-stage security measures.

The current status of tripscan-now.online remains active and evolving, with no immediate signs of takedown or remediation. Users and organizations are strongly advised to block access to this domain at the network perimeter and update firewall rules accordingly. All employees and customers should be alerted to avoid interacting with the domain or any associated subdomains. Security teams are encouraged to monitor for any newly observed phishing lures referencing “tripscan-now.online” or similar travel-themed decoys. Immediate reporting to relevant CERT teams and domain registrars is recommended to accelerate investigative and takedown efforts. Continuous monitoring of this threat vector is advised due to the domain’s active status and low detection footprint.