trackp1[.]com

Analysis of trackp1.com indicates active phishing infrastructure designed to impersonate tracking or logistics services. The domain was registered on June 22, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with abusive registrations. It resolves to IP address 216.150.1.1, hosted on infrastructure belonging to Vercel, Inc. in the United States. Cloudflare nameservers (nora.ns.cloudflare.com and rick.ns.cloudflare.com) are configured, a common tactic to obscure hosting origins and complicate takedown efforts. The site presents an HTTP 308 redirect status, suggesting it may be part of a multi-stage phishing chain or used to filter and forward victims to secondary malicious endpoints. The page title 'TrackP1' aligns with logistics or parcel-tracking themes, though the exact content and targeted brand remain unconfirmed due to lack of direct analysis. Two security vendors on VirusTotal flag the domain as malicious, and it appears in two AlienVault OTX threat intelligence pulses, reinforcing its classification as active phishing infrastructure. The domain is also blocked by PhishDestroy and listed on one additional security blocklist, with a Gridinsoft trust score of 0/100 indicating no legitimate use. Defenders should treat this domain as high-risk and prioritize blocking at DNS, proxy, and endpoint levels. The SSL certificate issued by Let's Encrypt (YR2) provides no meaningful trust signal, as it is routinely abused in phishing operations. Given the domain's recent registration and consistent detection across multiple threat feeds, it is likely part of a broader campaign still in active deployment. Further monitoring of associated IPs, certificates, and redirect chains is recommended to identify related infrastructure.