emiratespost[.]traniit[.]top

Analysis indicates that the domain emiratespost.traniit.top was registered on March 07, 2026 through Dominet (HK) Limited. The authoritative name servers nico.ns.cloudflare.com and rosalie.ns.cloudflare.com resolve the zone to the Cloudflare edge address 172.67.178.233, which is associated with AS13335 Cloudflare, Inc. and geolocates to the United States. No TLS certificate is presented; the site serves HTTP without a valid certificate and returns the default nginx page title “Welcome to nginx!”. The lack of a valid certificate and the generic server banner are typical of temporary or throw‑away phishing infrastructure. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy sinkhole.

Google Safe Browsing classifies it as social engineering, and Gridinsoft assigns a trust score of 0 / 100, indicating a high likelihood of malicious intent. VirusTotal reports that 7 of 95 scanned security vendors flagged the host, reinforcing the suspicion. The site is currently marked offline, which may be the result of takedown actions or the operator shutting down the temporary host. Uncertainties remain regarding the specific phishing campaign, such as the targeted brand or credential‑capture page, because no page content beyond the nginx title has been captured. No evidence of additional infrastructure, such as command‑and‑control servers or payload delivery, is available in the public data.

Defenders should continue to block the domain at network perimeter devices, DNS filters, and endpoint protection suites. Adding the domain to internal blocklists and monitoring for any future resolution to the same Cloudflare IP range is advisable. Because the domain uses Cloudflare’s shared infrastructure, any future sub‑domains created by the same actor may resolve to similar IP ranges; therefore, heuristic detection of rapid domain creation combined with the observed registrar (Dominet (HK) Limited) can help surface related threats.