pay-travla[.]icu

This domain, pay-travla.icu, is flagged as a generic phishing site targeting users of the Travala travel booking platform, a service known for cryptocurrency payment integration. Analysis indicates the site is designed to harvest credentials, payment details, or cryptocurrency wallet information under the guise of legitimate booking services. No specific drainer kit signatures have been identified at this stage, but the infrastructure aligns with common phishing deployment patterns observed in travel and crypto-related scams. Infrastructure analysis reveals the following technical indicators: the domain was registered on July 05, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to IP address 172.67.199.141, a Cloudflare proxy endpoint that obscures the true origin server. VirusTotal reports 0/95 detections, indicating no antivirus engines have flagged the domain as malicious at the time of assessment. The SSL certificate is issued by Google Trust Services, providing a false sense of security. Google Safe Browsing (GSB) status remains unlisted, and no blocklist entries have been recorded across major threat intelligence platforms. Current status remains active, with the site still serving content under the title 'Travala Booking.' Immediate response actions include monitoring for changes in detection status, analyzing the backend infrastructure for further indicators of compromise, and assessing the domain's hosting environment for additional malicious artifacts. Despite the lack of detections, the domain poses a high residual risk due to its active impersonation of a legitimate service and the potential for credential or financial data theft. Users are advised to avoid interaction with the domain, verify URLs through official channels, and report suspicious activity to relevant fraud prevention entities.