tripscan76[.]live

Analysis of tripscan76.live shows that the domain was registered on July 24, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently resolved to the IPv4 address 185.130.47.48. The authoritative name servers are lamar.ns.cloudflare.com and lisa.ns.cloudflare.com, indicating that the domain is using Cloudflare’s DNS infrastructure. VirusTotal reports a single positive detection out of 91 scanning engines, confirming that at least one vendor has identified malicious activity associated with the domain.

The same domain is listed on one external security blocklist and has been actively blocked by the PhishDestroy feed, reinforcing the classification as a high‑risk phishing resource. No additional telemetry such as HTTP response codes, SSL certificate details, page title, or observed landing page content is available in the current intelligence set, so the exact phishing payload or targeted brand cannot be confirmed at this time. The limited detection surface—one blocklist entry and a single vendor flag—suggests that the campaign may be in an early stage or employing low‑profile hosting, but the recent creation date and active status indicate an ongoing threat.

Defenders should prioritize immediate containment by adding tripscan76.live to URL filtering and DNS sinkhole rules, block outbound connections to 185.130.47.48, and ensure that any existing network traffic logs are inspected for recent queries to this domain. Continuous monitoring of the domain’s reputation on VirusTotal and additional blocklist feeds is recommended, as further detections may surface rapidly. Given the association with a known phishing feed, organizations should also educate users about unsolicited communications that could direct them to this URL and enforce multi‑factor authentication to mitigate credential compromise.