tonspin[.]digital

tonspin.digital was registered on 21 February 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com. The site is currently offline and has been taken down by the PhishDestroy takedown service. HTTP analysis shows the page title “TON WHEEL”, which aligns with the reported crypto gambling scam type. The domain resolves to the IPv6 address 2606:4700:3030::6815:5001, an address owned by Cloudflare, Inc. (AS13335) and geolocated to the United States. No TLS certificate was presented, indicating that the site operated without HTTPS protection.

VirusTotal scans recorded ten detections out of ninety‑five AV engines, confirming the presence of malicious indicators. The domain is listed on a single external blocklist and has been flagged by PhishDestroy, suggesting that threat‑intelligence feeds have already recognized it as hostile. Evidence confirms the association with a crypto gambling phishing campaign, but the exact payload, victim interaction flow, and command‑and‑control infrastructure remain undocumented. The lack of an SSL certificate, combined with the use of Cloudflare’s network, points to a typical fast‑flux hosting pattern intended to obscure the true origin of the malicious server.

No additional intelligence such as OTX tags, Safe Browsing status, or further blocklist entries is available, leaving the full scope of the campaign uncertain. Defenders should update URL and domain filtering rules to block tonspin.digital at the perimeter, add the IPv6 address to host‑based deny lists, and monitor for any resurgence of the domain or similar TOR‑related gambling pages. Continuous ingestion of threat‑intel feeds that reference the “TON WHEEL” title can aid in early detection of copy‑cat domains. Given the confirmed detections on VirusTotal and the active takedown by PhishDestroy, the domain should be treated as high‑confidence malicious and incorporated into security controls accordingly.