tolami[.]site

Analysis of the domain tolami.site, observed on July 24, 2026, indicates an elevated‑risk brand‑impersonation operation targeting Apple. The domain was registered on May 25, 2025 through NameCheap, Inc. and resolves to the IPv6 address 2a06:98c1:3120::3, which is hosted by Cloudflare (AS13335) in the United States. The site is currently offline, and its status is recorded as taken offline in the intelligence feed. The page title returned by the server reads “OppiWallet - Secure Crypto Wallet & Payment Platform,” suggesting a cryptocurrency‑related lure, while the listed scam type is a Tech Support Scam, implying that victims may be prompted to grant remote access or install malicious utilities.

The domain appears on a single security blocklist and is actively blocked by PhishDestroy, providing a concrete mitigation point for network defenders. VirusTotal scans show that four of ninety‑three security vendors flagged the domain, reinforcing the suspicion of malicious intent despite a limited detection footprint. The SSL certificate is identified only as “WE1,” offering no additional validation of legitimacy. Gridinsoft assigns a trust score of 0 / 100, effectively marking the site as untrusted.

No further evidence about the page’s content, phishing kit, or credential‑capture mechanisms is available. Given the combination of brand‑impersonation labeling, the Apple target, the tech‑support scam classification, and the presence on blocklists, defenders should continue to block tolami.site at the DNS and firewall layers, monitor the associated IP address for reuse, and include the domain in threat‑intel feeds. Continuous observation of any re‑registration attempts or similar naming patterns is recommended, as the infrastructure—particularly the Cloudflare‑served IPv6 address—could be repurposed for future campaigns.