tripscan72[.]pw

PhishDestroy identifies tripscan72.pw as an active credential theft domain currently under investigation. This domain is associated with a phishing campaign designed to harvest user login credentials under false pretenses. As of the latest assessment, the threat remains active and is being closely monitored for further developments. This domain was flagged by 2 of 95 VirusTotal vendors, indicating that it has not yet been widely detected by security solutions. The domain resolves to IP address 185.130.47.48 and is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. The domain was created on March 23, 2026, and is secured with a Let's Encrypt SSL certificate. Historical data shows no prior association with known blocklists or trust score platforms, suggesting this is a newly deployed threat infrastructure. Given the lack of vendor detections and the domain's recent creation, the risk of exposure to credential theft remains high for unaware users. PhishDestroy advises organizations and individuals to block tripscan72.pw at the network level and educate users about this emerging threat. Additionally, monitor network traffic for connections to the associated IP address (185.130.47.48) and inspect SSL certificates for anomalies. Immediate reporting of any encountered phishing attempts involving this domain is encouraged to aid in ongoing investigations.