tripscan78[.]info

Analysis of tripscan78.info shows a newly registered domain created on July 24, 2026 that is currently active and associated with a generic phishing campaign. The registrar listed for the domain is NICENIC INTERNATIONAL GROUP CO., LIMITED, indicating a legitimate registration channel but providing no indication of malicious intent. The domain resolves to the IP address 203.12.31.79 and uses Cloudflare DNS services, as evidenced by the authoritative nameservers josephine.ns.cloudflare.com and kyle.ns.cloudflare.com.

The SSL certificate is issued by Let’s Encrypt under the YE1 identifier, offering valid HTTPS encryption but offering no protection against the underlying malicious content. The domain is flagged by PhishDestroy and appears on one external security blocklist, confirming that at least one reputable anti‑phishing organization has taken mitigation action. VirusTotal reports that 1 of 91 security vendors has flagged the domain, providing additional independent confirmation of suspicious behavior.

No public Safe Browsing, OTX, HTTP status, trust score, page‑title, or evidence‑link data are presently available, leaving those aspects of the threat surface unverified. Defenders should add tripscan78.info to inbound and outbound filtering rules, monitor DNS queries for the associated IP and Cloudflare nameservers, and ensure that any user‑initiated connections to the domain are blocked or sandboxed. Continuous re‑evaluation is advised, as additional detection vendors may update their verdicts and further blocklist entries could emerge as the campaign evolves.