triumex[.]space

On 24 July 2026, security researchers observed that the domain triumex.space resolves to the Cloudflare‑owned address 188.114.97.3, which is advertised as belonging to AS13335 in the United States. The domain was registered on 5 October 2025 through Web Commerce Communications Limited and is served by the authoritative name servers anuj.ns.cloudflare.com and colette.ns.cloudflare.com. The TLS handshake presents a certificate issued by Google Trust Services under the WE1 root, indicating a valid HTTPS endpoint despite the underlying malicious activity. Multiple intelligence sources have flagged the domain. PhishDestroy has listed it as a blocked phishing site, and it appears on a single external security blocklist.

VirusTotal scans show that 11 of 95 scanning engines returned a malicious verdict, reinforcing the suspicion of abuse. AlienVault OTX references the domain in fifteen separate threat‑intel pulses, suggesting it has been shared across community feeds. The site currently returns an HTTP 404 Not Found status, and the page title reported by scanners is “404 Not Found”, indicating that the payload has been removed or the host has taken the site offline. Nonetheless, the presence of Cloudflare Browser Insights and HTTP/3 traffic signatures confirms that the domain was actively serving content prior to takedown. The available evidence points to triumex.space being used for a generic phishing campaign, although the specific lure or credential‑stealing vector has not been captured in the public data.

Because the domain is hosted behind Cloudflare, the underlying server IP may be shared with unrelated legitimate services, complicating direct takedown. Defenders should therefore add triumex.space to DNS‑based deny lists, monitor DNS queries for the associated Cloudflare name servers, and consider blocking outbound connections to 188.114.97.3 pending further investigation.