tramp-event[.]ac

Analysis as of July 23, 2026 indicates that tramp-event.ac is currently offline but was previously identified as a generic phishing infrastructure. The domain was registered on 10 November 2025 through Web Commerce Communications Limited and is hosted on Cloudflare’s network (AS13335) with the address 188.114.97.3 located in the United States. DNS resolution uses Cloudflare’s authoritative name servers abdullah.ns.cloudflare.com and sneh.ns.cloudflare.com, a pattern commonly observed in fast-flux or abuse-resilient phishing campaigns. No TLS certificate was presented; HTTP requests returned a 404 Not Found page title, suggesting the site was taken down or never served legitimate content. Reputation services have flagged the domain.

PhishDestroy lists it as blocked, and Gridinsoft assigns a trust score of 0 out of 100. VirusTotal reports that 11 of 95 scanning engines flagged the domain as malicious, reinforcing the suspicion of phishing activity. The domain appears on a single external blocklist, further confirming that security communities have taken action against it. Uncertainty remains regarding the specific payload or credential-harvesting mechanisms that were hosted, as the site content is not available for analysis and no SSL certificate or detailed page markup was captured. Consequently, the exact phishing lure cannot be confirmed beyond the generic classification.

Defenders should continue to block tramp-event.ac at perimeter defenses, DNS filters, and proxy devices. Monitoring of the associated IP address 188.114.97.3 is advised, as Cloudflare hosts multiple unrelated customers and the address may be reused. Update internal threat intel feeds with the domain registration date, registrar, and name-server details to aid correlation with future campaigns that reuse similar infrastructure.