torifinance[.]sbs

The domain torifinance.sbs was registered on 5 August 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is hosted on Cloudflare infrastructure, using the authoritative name servers ezra.ns.cloudflare.com and poppy.ns.cloudflare.com. DNS resolution points to the IP address 188.114.97.3, which is associated with Cloudflare’s CDN network. The domain appears on a single security blocklist and is actively blocked by the PhishDestroy service, indicating that at least one threat‑intelligence feed has classified it as malicious.

VirusTotal records show the domain has been examined by 91 antivirus and URL scanning engines, none of which reported a detection at the time of analysis; this absence of detections does not constitute confirmation of safety. No public page title or content snapshot is currently available, so the specific phishing lure or targeted brand cannot be confirmed from open‑source data. The short lifespan between registration and first observation (one day) is consistent with rapid‑deployment phishing campaigns.

Given the combination of recent registration, Cloudflare hosting, blocklist presence, and active blocking by PhishDestroy, the domain should be treated as a high‑confidence phishing indicator. Defensive actions include adding the domain and its resolving IP to outbound‑traffic deny lists, monitoring DNS queries for the associated Cloudflare name servers, and updating URL filtering rules in web gateways. Analysts should continue to collect page‑content samples and monitor any further reports that might reveal the targeted brand or credential‑harvesting tactics.