balmoraltours[.]com

Analysis of balmoraltours.com shows that the domain was registered on October 26, 2022 through PDR Ltd. d/b/a PublicDomainRegistry.com and is served by the nameservers ns1.hpdns.net, ns2.hpdns.net, ns3.hpdns.net, and ns4.hpdns.net. The domain resolves to the IPv4 address 216.128.154.247 and remains active as of the report date. VirusTotal scans have flagged the domain in 14 of 91 security vendor engines, indicating a moderate level of detection across independent scanners. The domain also appears in a single AlienVault OTX threat pulse, further corroborating its association with malicious activity. The threat type is listed as generic_phishing, and the risk level is classified as high. While these indicators confirm that the domain is being used in phishing campaigns, the specific payload, targeted brands, or victim interaction flow have not been publicly disclosed. Defenders should block network traffic to 216.128.154.247, add balmoraltours.com to URL filtering lists, and monitor for related DNS queries. Continuous re‑evaluation is recommended, as additional intelligence may emerge regarding the phishing kit or victim profile.