tripscantrevel[.]com

The domain tripscantrevel.com was created on July 24, 2026 and is currently active. Registration records show it was obtained through NICENIC INTERNATIONAL GROUP CO., LIMITED, and the authoritative name servers are june.ns.cloudflare.com and vicky.ns.cloudflare.com, indicating use of Cloudflare’s DNS infrastructure. The domain resolves to the IP address 104.21.81.71, which is associated with Cloudflare’s edge network and therefore masks the underlying hosting provider. An SSL certificate for the domain is issued by Google Trust Services under the WE1 label, confirming that TLS termination is handled by a reputable certificate authority.

Threat intelligence indicates that the domain has been blocked by the PhishDestroy service and appears on one external security blocklist. VirusTotal analysis reports that one out of ninety‑one scanned security vendors flagged the domain as malicious, suggesting at least one detection engine identified suspicious behavior. Additionally, AlienVault OTX lists the domain in two separate threat‑intelligence pulses, providing corroborating evidence of its involvement in malicious campaigns.

The available data classifies the activity as generic phishing, though specific page content or target brand details have not been disclosed. Defenders should consider adding tripscantrevel.com to deny‑list rules, monitor DNS queries for the associated Cloudflare name servers, and enforce TLS inspection to verify the legitimacy of any traffic to the IP address 104.21.81.71. Ongoing observation of blocklist status and VirusTotal re‑scans is recommended to capture any changes in the domain’s threat profile.