tracingfraud[.]com

On July 25, 2026 analysts observed that the domain tracingfraud.com was taken offline after being identified as a brand‑impersonation site targeting the Scroll service. The domain was registered on August 16, 2025 through NameCheap, Inc. and resolves to the IPv4 address 192.64.117.217, which is hosted in the United States under ASN 22612, also owned by NameCheap. No TLS certificate is present on the host, indicating that the site operated over plain HTTP only. Reputation services show a Gridinsoft trust score of 0 out of 100 and the domain appears on a single security blocklist. VirusTotal records indicate that 2 of 95 scanned security vendors flagged the domain, confirming that at least a minority of scanners detected malicious behavior.

The site was also listed by the PhishDestroy blocklist, reinforcing its classification as a phishing‑related resource. The page title returned by the HTTP response was “Home - TracingFraud”, which does not reference the impersonated brand and provides no further context about the content served. Nameservers dns1.namecheaphosting.com and dns2.namecheaphosting.com were observed, consistent with the registrar’s default configuration. Evidence confirms the domain’s intent to impersonate the Scroll brand, but the precise tactics—such as credential‑harvesting forms or redirect chains—were not captured before the takedown.

Consequently, the full payload and user‑experience remain unknown. Defenders should continue to monitor the associated IP address and the NameCheap hosting range for any re‑use of the infrastructure, and ensure that outbound filtering rules block traffic to 192.64.117.217. Organizations that employ Scroll services should update internal phishing‑detection signatures to include the observed page title and the domain’s registration details.