traveloo[.]live

The domain traveloo.live was registered on July 26, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently resolving to the IPv4 address 142.11.217.80. The authoritative name servers are ns51.hostwindsdns.com and ns52.hostwindsdns.com, indicating the domain is hosted on the Hostwinds platform. Threat intel classifies the site as a generic phishing operation and the infrastructure remains active as of the report date, July 31, 2026. The domain appears on a single security blocklist and has been blocked by the PhishDestroy mitigation service, suggesting that at least one external sinkhole or filtering solution has identified it as malicious.

VirusTotal analysis shows the domain was submitted to 91 scanning engines, with none of the engines reporting a detection at the time of the scan; the absence of detections does not constitute a safety guarantee and should be interpreted as a lack of current signatures rather than proof of benign intent. No public Safe Browsing, Open Threat Exchange, SSL certificate, HTTP response code, trust‑score, or page‑title information is available in the current intelligence set, leaving those vectors unverified. Defenders should prioritize adding traveloo.live to internal blocklists and ensure that outbound traffic to the resolved IP address 142.11.217.80 is denied or monitored.

Continuous re‑scanning with multi‑vendor services is advised to capture any future payload changes. Monitoring of the Hostwinds name servers for new sub‑domains or similar domains registered by the same registrar may reveal additional phishing infrastructure. Organizations using email filtering should confirm that the domain is flagged by their anti‑phishing modules and, where possible, enforce URL rewriting or sandbox analysis for any user‑initiated requests to traveloo.live.