trumpgift[.]net

The domain trumpgift.net was registered on May 18 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently marked as active. HTTP requests return a 403 status code, indicating that the web server is deliberately denying access to standard GET requests. The site presents a TLS certificate issued by a public ACME authority, identified as an E8‑type certificate, which is typical for rapidly deployed domains.

Infrastructure analysis shows the domain resolves to the IPv4 address 188.114.96.3. The address is owned by a Canadian CDN operator, providing anonymity and traffic mitigation. Authoritative name servers are monika.ns and yisroel.ns, both belonging to a well‑known DNS provider. The domain appears on a single security blocklist and has a Gridinsoft trust score of 0 out of 100, reflecting a high confidence of malicious intent. VirusTotal reports that four of ninety‑five scanners flag the domain, and it is listed in one AlienVault OTX pulse, confirming its presence in threat‑intel feeds.

The 403 response prevents direct observation of the payload, leaving the exact phishing content uncertain. No landing page or credential‑harvesting form has been captured, so the specific tactics, targeted brands, or credential types remain unknown. The limited number of detections suggests the campaign may be in an early stage or is employing a low‑volume delivery model, but the presence of multiple independent detections indicates a non‑trivial risk.

Defenders should treat trumpgift.net as a high‑risk indicator. Immediate actions include adding the domain to network deny lists, enforcing URL filtering for outbound traffic, and monitoring DNS queries for resolutions to the associated IP address. Where possible, redirecting requests to a sinkhole can capture additional telemetry. Continuous re‑evaluation is advised, as future content changes could increase the attack surface.