tofcoin[.]com

PhishDestroy identifies tofcoin.com as a credential theft domain actively masquerading as a legitimate cryptocurrency exchange platform. The site is designed to deceive users into entering sensitive login credentials, which are then harvested by threat actors for unauthorized access to real exchange accounts, crypto wallets, or other high-value targets. No evidence of a crypto drainer kit was detected during initial analysis, but the presence of a credential harvesting framework is strongly indicated by the domain’s naming and page structure, which closely mirrors established financial service brands. The site’s operators appear to be leveraging brand impersonation to establish credibility and lower user suspicion, a common tactic in credential theft campaigns targeting crypto investors and traders. tofcoin.com exhibits multiple red flags in its technical configuration. The domain was registered on March 31, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, indicating recent acquisition. It resolves to IP address 172.67.178.86 and is secured with a Let's Encrypt SSL certificate, which, while legitimate, is frequently exploited by threat actors to lend false legitimacy to phishing pages. As of the latest scan, the domain shows 0 detections out of 95 on VirusTotal, suggesting it has not yet been widely flagged by security vendors. Google Safe Browsing (GSB) status remains unconfirmed, and no blocklist entries were found in public threat intelligence feeds at the time of analysis. The domain’s age and lack of detections place it in a high-risk window where it may remain dormant or escalate attacks unpredictably. The current status of tofcoin.com is active and under investigation, with no confirmed takedown or remediation applied. Response actions include monitoring by PhishDestroy and submission to threat intelligence networks for broader detection. However, the absence of detections on VirusTotal and the domain’s recent registration date introduce uncertainty regarding its operational timeline and potential victim count. Users are strongly advised to avoid interacting with tofcoin.com, refrain from entering credentials or personal data, and report any suspicious activity to their security teams or relevant financial platforms. Until the domain is formally blocked or neutralized, the risk of credential theft remains elevated, particularly for users expecting legitimate crypto exchange services.