tfh-orb[.]com

The domain tfh-orb.com has been identified as a generic phishing site with an elevated risk level. As of the latest assessment, the domain is currently offline and no longer operational. It impersonates a social network, which is indicated by its page title: 'World - Das Netzwerk echter Menschen'.

Analysis indicates that tfh-orb.com has been flagged by 5 of 95 security vendors on VirusTotal, suggesting a relatively low but significant level of suspicion. The domain was registered through Dynadot Inc and resolves to the IP address 2606:4700:10::6814:24ab. It was created on January 09, 2026, and has appeared on 3 security blocklists. The Gridinsoft trust score for this domain is 0 out of 100, indicating a complete lack of trustworthiness. The site was blocked by MetaMask, PhishDestroy, and SEAL. Infrastructure analysis reveals the use of technologies such as Prismic, Apple iCloud Mail, Node.js, React, Amazon Web Services, Vercel, Next.js, and Zendesk, which are commonly employed in legitimate web development but can also be leveraged for malicious purposes.

The current status of tfh-orb.com is offline, which mitigates the immediate threat to users. However, it is recommended that organizations and individuals continue to monitor for any resurgence of the domain. Security teams should update their threat intelligence databases to include this domain and its associated IP address. Additionally, users should be educated on the signs of phishing and encouraged to verify the legitimacy of any social network links before clicking.