12-trip[.]biz

Analysis indicates that 12-trip.biz is an active phishing domain targeting users of the travel service One Two Trip. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, and currently resolves to the IP address 172.67.161.8, hosted on Cloudflare's network (AS13335). The page title, 'Все товары - One Two Trip!', explicitly references the One Two Trip brand, suggesting an attempt to deceive users into believing the site is affiliated with the legitimate service. The domain is flagged by one security blocklist (PhishDestroy) and is assigned a Gridinsoft trust score of 0/100, further supporting its classification as malicious infrastructure.

Infrastructure analysis reveals the use of Cloudflare nameservers (isaac.ns.cloudflare.com and ruth.ns.cloudflare.com) and an SSL certificate issued by Google Trust Services (WE1). The HTTP status code 302 indicates a redirect, which is a common tactic in phishing campaigns to obscure the final destination or evade detection. Detected technologies include Highcharts, Slick, Select2, jQuery, and HTTP/3, which are not inherently malicious but are frequently employed in phishing sites to enhance functionality and mimic legitimate platforms. At the time of reporting, VirusTotal shows a detection rate of 1 out of 93 security vendors, which, while low, aligns with the early stage of the domain's deployment or the use of evasion techniques.

The domain remains active as of July 24, 2026, with no evidence of takedown or remediation. Defenders should treat this domain as high-risk and consider blocking it at the network level or via endpoint protection solutions. Additional monitoring of related infrastructure, such as domains registered through the same registrar or resolving to the same IP range, may uncover further malicious activity.