tondex[.]net

Analysis indicates that the domain tondex.net was registered on March 30, 2026 through ENOM, INC. The domain resolves to the IPv4 address 23.254.231.184 and uses Cloudflare name servers fiona.ns.cloudflare.com and hunts.ns.cloudflare.com. VirusTotal has processed the domain with 91 AV engines, none of which returned a detection at the time of scanning; this absence of detections does not imply the domain is benign. The domain is currently listed on one public security blocklist and has been actively blocked by the PhishDestroy service.

No additional public reputation services, Safe Browsing checks, or Open Threat Exchange (OTX) entries were observed in the available data. The domain remains live and reachable, and its risk level is marked as “under investigation” while its operational status is “active”. The lack of publicly disclosed page title, SSL certificate details, or HTTP response codes limits the ability to characterize the hosted content or any credential‑harvesting mechanisms that may be present. Consequently, defenders cannot confirm the exact phishing lure or targeted brand.

Given the limited visibility, defensive teams should treat tondex.net as a potentially malicious phishing infrastructure. Recommended actions include adding the domain and its resolved IP address to outbound and inbound deny lists, monitoring DNS queries for the domain, and employing URL filtering solutions that reference the known blocklist entry. Continuous re‑scanning with multi‑engine services and periodic checks of reputation feeds are advised to capture any future changes in detection status. Organizations should also verify that email security gateways are configured to flag messages containing links to tondex.net, and incident response procedures should be prepared to investigate any user reports of suspicious activity involving this domain.