tourismplanes[.]shop

PhishDestroy identifies tourismplanes.shop as an active generic phishing domain designed to deceive users with counterfeit travel vouchers. The site employs a crypto drainer kit to siphon cryptocurrency from unwitting victims who engage with the fraudulent offers. No specific brand impersonation has been detected at this stage, suggesting a broad, opportunistic campaign targeting travel enthusiasts. The domain’s infrastructure prioritizes quick setup and evasion, typical of low-cost, high-volume scams operating under minimal overhead. This domain resolves to IP address 104.21.7.18 and leverages a Google Trust Services SSL certificate to appear legitimate. VirusTotal currently shows 0/95 security vendors flagging the domain, indicating a low detection rate despite its active status. The domain was registered recently and remains unlisted on Google Safe Browsing (GSB), further contributing to its stealth. Additional technical indicators remain under analysis, but the absence of blocklist entries suggests this threat is still in its early propagation phase. As of this report, tourismplanes.shop is classified as active with a risk level of 'under_investigation.' PhishDestroy has flagged this domain for immediate scrutiny, and takedown efforts are underway in coordination with hosting providers and domain registrars. Users are strongly advised to avoid interacting with this domain and to utilize PhishDestroy’s real-time scanning tools to verify suspicious links. The remaining risk is moderate due to the domain’s low detection profile and potential for rapid expansion across travel-related platforms.