trump-gifts[.]io

This domain, trump-gifts.io, is flagged as an active phishing infrastructure targeting users through politically themed scam tactics. Registered on February 21, 2026, via Regional Network Information Center, JSC dba RU-CENTER, the domain currently resolves to 104.21.83.211, an IP address assigned to Cloudflare, Inc. (AS13335) in the United States. Analysis indicates the site is protected by Cloudflare, utilizing HTTP/3 and presenting a 403 HTTP status, which suggests access restrictions or backend misconfiguration. The page title, 'trump-gifts.io | 523: Origin is unreachable,' further implies server-side issues, though this does not diminish its classification as a high-risk phishing domain. Infrastructure analysis reveals the domain is hosted behind Cloudflare nameservers (pat.ns.cloudflare.com and rommy.ns.cloudflare.com), a common tactic to obscure origin servers and evade takedowns. It appears on at least one security blocklist, and Google Safe Browsing has flagged it for social engineering. While the exact content of the site remains unanalyzed, the domain name and associated metadata suggest an attempt to exploit political branding for fraudulent purposes. Seven out of ninety-five security vendors on VirusTotal have flagged the domain, reinforcing its malicious classification. Defenders should treat this domain as active and high-risk. The SSL certificate, issued by Google Trust Services (WE1), does not validate the site's legitimacy, as phishing domains frequently use valid certificates to appear trustworthy. Network-level blocking of 104.21.83.211 and monitoring for related domains registered through the same registrar may mitigate exposure. Given the domain's recent creation and Cloudflare-backed infrastructure, further monitoring is recommended to track potential shifts in hosting or content delivery. No concrete evidence links this domain to a specific phishing kit or campaign, but its political branding aligns with known social engineering tactics.