tripscan-map[.]ru

This domain, tripscan-map.ru, is flagged as a credential theft operation targeting users of the TripScan platform. Analysis indicates the site impersonates the legitimate TripScan service, likely to harvest login credentials, payment details, or personal data under the guise of a travel or mapping application. The page title, "TripScan | ТрипСкан," reinforces the brand impersonation, suggesting a targeted campaign against Russian-speaking users or those familiar with the TripScan name.

Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 185.130.47.48 and was registered on April 08, 2026, through REGRU-RU. It appears on one security blocklist and is currently blocked by PhishDestroy. VirusTotal reports 2 out of 95 security vendors flagging the domain as malicious, while Gridinsoft assigns a trust score of 0/100. No detections are recorded in Google Safe Browsing at this time, though the domain's creation date is anomalous, predating the current year by several years, which may indicate domain squatting or a typo-squatting strategy.

The domain is currently offline, reducing immediate exposure risk. However, the infrastructure remains registered and could be reactivated. Organizations should proactively block the domain and its associated IP at the network level. Users who may have interacted with the site should reset credentials for any accounts accessed during the exposure window, particularly those linked to travel, financial, or email services. Monitoring for follow-up phishing attempts via email or SMS is recommended, as credential theft operations often lead to secondary attacks.