accounts[.]tnfirm[.]icu

The domain accounts.tnfirm.icu was registered on May 16, 2026 through NameSilo, LLC. Its authoritative name servers are maleah.ns.cloudflare.com and phil.ns.cloudflare.com, both operated by Cloudflare’s DNS platform. DNS resolution returns a single IPv4 address, 188.114.96.3, which belongs to Cloudflare’s edge network. VirusTotal analysis indicates that 14 of 91 security vendors have flagged the domain as malicious, reflecting a notable level of consensus among scanning engines.

The domain appears on one public security blocklist and is explicitly blocked by the PhishDestroy sinkhole, reinforcing its classification as a phishing infrastructure. The threat type is identified as credential phishing, with an elevated risk rating and an active status. No additional metadata such as SSL certificate details, HTTP response codes, or page title have been disclosed, so the content served by the host remains unverified.

The observable indicators suggest a purpose‑built domain for harvesting login credentials, likely targeting users of services that employ similar naming conventions. Defenders should add the IP address 188.114.96.3 and the domain accounts.tnfirm.icu to network and endpoint blocklists, enforce DNS filtering for the domain, and monitor for any outbound connections to the associated Cloudflare edge nodes. Continuous re‑scanning on multi‑vendor platforms is recommended to capture any changes in detection scores, and security teams should correlate authentication attempts with this indicator to identify compromised accounts.