tonnelgift[.]run

PhishDestroy identifies tonnelgift.run as a generic phishing domain impersonating the Markets brand, now confirmed offline. This domain was designed to deceive users into believing they were accessing a legitimate Markets platform, a common tactic in credential theft and financial fraud. The site's title, 'MARKETS,' was a clear indicator of its attempt to mimic a well-known trading or investment interface, luring unsuspecting visitors into submitting sensitive information.

Technical analysis reveals that tonnelgift.run was flagged by 7 of 95 VirusTotal vendors, indicating partial detection by the security community. The domain resolves to IP address 104.21.47.119 and was registered through Cloudflare, Inc. It appears on one security blocklist. The SSL certificate was issued by Google Trust Services under the WE1 classification, which is commonly used for Cloudflare-proxied sites, adding a layer of legitimacy that phishers exploit. These technical indicators suggest a moderately sophisticated phishing operation aimed at evading initial detection.

As the domain is now taken offline, the immediate risk is mitigated, but users should remain vigilant. PhishDestroy recommends that anyone who interacted with tonnelgift.run change their passwords immediately, enable multi-factor authentication on all accounts, and monitor financial statements for unauthorized activity. Organizations associated with the Markets brand should issue internal warnings and scan for compromised credentials. Always verify URLs before entering login credentials, and report suspicious domains to security teams or anti-phishing services.