# trifinorses.net — MALICIOUS

> trifinorses.net is a low-risk active phishing domain flagged for social engineering. Avoid interactions and report suspicious activity immediately.

## Summary
PhishDestroy identifies trifinorses.net as an active phishing domain involved in social engineering tactics aimed at deceiving users. Categorized under generic phishing with a low risk level, this domain poses potential threats by luring victims into divulging sensitive information or credentials. The domain's recent creation and presence on security blocklists emphasize caution.

The domain trifinorses.net was registered on January 5, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a common registrar for both legitimate and malicious domains. It resolves to the IP address 172.67.140.184. Despite appearing on two separate security blocklists, VirusTotal reports only one out of 95 security vendors flagging this domain, while Google Safe Browsing has categorized the site under "SOCIAL_ENGINEERING," suggesting attempts to trick users rather than exploit software vulnerabilities.

Currently, trifinorses.net remains active and continues to be monitored. Users and security teams are advised to avoid visiting or interacting with the domain, and to report any suspicious emails or links originating from this source. Continuous vigilance and updating of security tools to detect social engineering threats are recommended to mitigate potential risks associated with this domain.

## Threat Details
- Verdict: MALICIOUS
- Site status: alive (HTTP 200)
- Page title: Trifinorses

## Domain Intelligence
- Registered: 2026-01-05 00:00:00
- Registrar: PDR Ltd. d/b/a PublicDomainRegistry.com
- IP: 172.67.140.184
- Nameservers: damian.ns.cloudflare.com,faye.ns.cloudflare.com

## Detection Status
- VirusTotal: 12 vendors flagged
  Vendors: ["CRDF", "CyRadar", "ESET", "Fortinet", "G-Data", "Google Safebrowsing", "Gridinsoft", "Lionic", "SOCRadar", "Sophos", "Webroot", "alphaMountain.ai"]
- Google Safe Browsing: FLAGGED
- Blocklists: 3 hits
  Lists: ["PhishDestroy", "MetaMask", "SEAL"]

## Live Page Content

### Page Text
Trifinorses Trifinorses Verbleibende Plätze 38 Verdienen Sie über €950 TÄGLICH durch den Handel mit Trifinorses. Die Registrierung steht für deutsche Staatsbürger zur Verfügung. 4,7 Sterne von über 2.780 Nutzern Jetzt registrieren Bitte warten... Germany +49 +49 244 results found Afghanistan +93 Albania +355 Algeria +213 American Samoa +1 Andorra +376 Angola +244 Anguilla +1 Antigua & Barbuda +1 Argentina +54 Armenia +374 Aruba +297 Ascension Island +247 Australia +61 Austria +43 Azerbaijan +994 Bahamas +1 Bahrain +973 Bangladesh +880 Barbados +1 Belarus +375 Belgium +32 Belize +501 Benin +229 Bermuda +1 Bhutan +975 Bolivia +591 Bosnia & Herzegovina +387 Botswana +267 Brazil +55 British Indian Ocean Territory +246 British Virgin Islands +1 Brunei +673 Bulgaria +359 Burkina Faso +226 Burundi +257 Cambodia +855 Cameroon +237 Canada +1 Cape Verde +238 Caribbean Netherlands +599 Cayman Islands +1 Central African Republic +236 Chad +235 Chile +56 China +86 Christmas Island +61 Cocos (Keeling) Islands +61 Colombia +57 Comoros +269 Congo - Brazzaville +242 Congo - Kinshasa +243 Cook Islands +682 Costa Rica +506 Croatia +385 Cuba +53 Curaçao +599 Cyprus +357 Czechia +420 Côte d’Ivoire +225 Denmark +45 Djibouti +253 Dominica +1 Dominican Republic +1 Ecuador +593 Egypt +20 El Salvador +503 Equatorial Guinea +240 Eritrea +291 Estonia +372 Eswatini +268 Ethiopia +251 Falkland Islands +500 Faroe Islands +298 Fiji +679 Finland +358 France +33 French Guiana +594 French Polynesia +689 Gabon +241 Gambia +220 Georgia +995 Germany +49 Ghana +233 Gibraltar +350 Greece +30 Greenland +299 Grenada +1 Guadeloupe +590 Guam +1 Guatemala +502 Guernsey +44 Guinea +224 Guinea-Bissau +245 Guyana +592 Haiti +509 Honduras +504 Hong Kong SAR China +852 Hungary +36 Iceland +354 India +91 Indonesia +62 Iran +98 Iraq +964 Ireland +353 Isle of Man +44 Israel +972 Italy +39 Jamaica +1 Japan +81 Jersey +44 Jordan +962 Kazakhstan +7 Kenya +254 Kiribati +686 Kosovo +383 Kuwait +965 Kyrgyzstan +996 Laos +856 Latvia +371 Lebanon +961 Lesotho +266 Liberia +231 Libya +218 Liechtenstein +423 Lithuania +370 Luxembourg +352 Macao SAR China +853 Madagascar +261 Malawi +265 Malaysia +60 Maldives +960 Mali +223 Malta +356 Marshall Islands +692 Martinique +596 Mauritania +222 Mauritius +230 Mayotte +262 Mexico +52 Micronesia +691 Moldova +373 Monaco +377 Mongolia +976 Montenegro +382 Montserrat +1 Morocco +212 Mozambique +258 Myanmar (Burma) +95 Namibia +264 Nauru +674 Nepal +977 Netherlands +31 New Caledonia +687 New Zealand +64 Nicaragua +505 Niger +227 Nigeria +234 Niue +683 Norfolk Island +672 North Korea +850 North Macedonia +389 Northern Mariana Islands +1 Norway +47 Oman +968 Pakistan +92 Palau +680 Palestinian Territories +970 Panama +507 Papua New Guinea +675 Paraguay +595 Peru +51 Philippines +63 Poland +48 Portugal +351 Puerto Rico +1 Qatar +974 Romania +40 Russia +7 Rwanda +250 Réunion +262 Samoa +685 San Marino +378 Saudi Arabia +966 Senegal +221 Serbia +381 Seychelles +248 Sierra Leo

### External Scripts
- https://cdn.jsdelivr.net/npm/intl-tel-input@23.0.12/build/js/intlTelInput.min.js
- https://wipotey.com/validation.js

### Form Fields
- button
- country
- is_autologin
- utm_medium
- utm_content
- utm_term
- tel
- submit
- Ihren Vornamen
- fullphone
- domain
- lname
- pfb
- click_id
- email

## Evidence
- Screenshot: https://urlscan.io/screenshots/019cbe8b-8ff3-74ca-877a-8fc9322d0dbe.png
- Cloudflare Radar: https://radar.cloudflare.com/scan/f3c2a74b-fc5f-42ee-855f-1d8c631594af
- PhishDestroy: https://phishdestroy.io/domain/trifinorses.net/

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/trifinorses.net/
Last updated: 2026-03-14