tonelston[.]top

tonelston.top is a newly registered domain created on 21 November 2025 and currently listed as active with a high risk rating. The registration was performed through PDR Ltd. d/b/a PublicDomainRegistry.com. No explicit brand or target is disclosed in the available page title, which reads “Cierpliwości…”, indicating that the specific impersonated entity has not yet been identified. The domain resolves to the IP address 104.21.75.50, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. Authoritative nameservers are elias.ns.cloudflare.com and irena.ns.cloudflare.com, confirming that the site is fronted by Cloudflare’s CDN. TLS is provided by a Google Trust Services certificate (WE1), and the site negotiates HTTP/3. Fingerprinting of the web stack shows Node.js, React, Next.js, Webpack, and Cloudflare Browser Insights, suggesting a modern JavaScript‑heavy application. VirusTotal has recorded detections from 12 of 95 scanned security vendors, and Gridinsoft assigns a trust score of 0 out of 100, reflecting a strong malicious profile. The HTTP response code returned is 403, and the domain is already blocked by the PhishDestroy blocklist, appearing on one additional security blocklist. These indicators collectively confirm that the infrastructure is being used for malicious phishing activity. Defenders should add tonelston.top to outbound filtering and DNS sinkhole policies, and monitor any traffic that resolves to 104.21.75.50 for signs of credential harvesting or payload delivery. Continuous re‑evaluation of the domain’s content is advised, as the page title alone does not reveal the exact victim brand. Organizations employing email gateways should keep the domain on blocklists and consider threat‑intel sharing with peers to improve collective detection.