blockbasecoi.com 
Domain security and threat intelligence
tokonama[.]com
“Alojamiento activo”
Threat verdict
Critical
76/100 evidence score
Availability
Last known active
Latest stored reachability observation
Risk signals
VirusTotal detections: 3/91
Last known active
Evidence Summary
CRITICAL
The domain tokonama.com was registered on 17 April 2026 through the registrar 10dencehispahard, S.L. The registration is recent and the domain resolves to the IPv4 address 185.66.41.219, which is geolocated to Spain and associated with the same registrar. The nameserver set includes ns1.cdmon.net, ns2.cdmon.net, ns3.cdmon.net, ns4.cdmondns-01.org, and ns5.* (truncated). The website currently returns HTTP status code 200 and presents the page title “Alojamiento activo”.
TLS is provided by a Let’s Encrypt certificate (R13) that is valid for the domain, indicating that encrypted connections are available. The presence of a valid certificate does not mitigate the risk of credential harvesting, as the underlying content can still be malicious. The site’s content has not been flagged by VirusTotal (0 detections out of 95 engines), but the absence of detections should not be interpreted as a safety signal.
Threat intelligence sources have identified tokonama.com on a single security blocklist and it appears in one AlienVault OTX pulse. The domain has a Gridinsoft trust score of 0 out of 100, reinforcing the suspicion of malicious intent. Additionally, the domain is listed as blocked by the PhishDestroy blocklist, which specializes in phishing‑related infrastructure. These independent observations converge on a classification of generic phishing.
Uncertainty remains regarding the exact phishing campaign payload, the lure used, and the target audience. No public samples of the landing page have been shared, and the short lifespan of the domain limits historical analysis. Defenders should treat tokonama.com as malicious, enforce network‑level blocks for the domain and its resolving IP, and monitor DNS queries for related subdomains. Email security gateways should be tuned to flag messages that reference the domain or its URL patterns, and incident response teams should collect any credential submissions for further forensic examination.
VirusTotal
3 det.
OTX references
TLS Certificate
Expired or unverified -79d
Age
4 mo
Observed status
Last known active 200
DestroyList
Listed
Data coverage
VirusTotal
3 / 91
URLQuery
not checked
PhishStats
not checked
OTX
1 community reference
CF Radar
no data
URLScan capture
not submitted
URLScan verdict
verdict unavailable
DNS blocks
not checked
TLS
Expired or unverified
WHOIS
4 mo old
Screenshot
not captured
Redirect chain
not probed
Threat Response Pipeline
Discovery
Checks
Reports
Availability
6/8
Blocklist coverage
10 sources · synchronized Aug 10, 2026
Domain Intelligence
Domain
Server / ASN
Apache · AS197712 10dencehispahard, S.L.
IP Reputation
abuse score 0/100 0 reports checked Jul 13, 2026
Registrar
10dencehispahard, S.L
RegistrationCreated Apr 17, 2026 (114d)
HTTP Status200
Technical detailsDNS, TLS names and timestamps
First DetectedJun 13, 2026
Nameserversns5.cdmondns-01.com
TLS fingerprint
TLS observationvalid from Feb 22, 2026scanned Apr 17, 2026
ICANN OVERSIGHT
Accreditation and RAA context
Accreditation and RAA context
Registrar accreditation and DNS abuse obligations
For this gTLD, the registrar above operates under an ICANN accreditation agreement. The links below provide the official fee schedule and current DNS abuse compliance guidance.
Accreditation is a contract, not a safety certification.
RAA §3.18 establishes abuse-contact and handling requirements. This report can document stored outbound notices and later technical observations; it does not by itself establish receipt, investigation, remediation, or contractual non-compliance.
Accreditation is a contract, not a safety seal.
Verify ICANN fees
Read RAA §3.18
PHISHDESTROY INVESTIGATIONICANN funding, contracts, and DNS abuse oversight
Report This Domain
Submit evidence & help protect others
VirusTotal Analysis
3 / 91 security vendors flagged this domain
View on VT
Last analyzed First positive detection Previous stored snapshot: 0 detections
CRDF
Gridinsoft
SOCRadar
Site Performance Analysis
Google PageSpeed Insights — mobile performance audit of tokonama.com · checked Apr 18, 2026
90
Good
Performance
FCP
1.53s
First Contentful Paint
LCP
1.53s
Largest Contentful Paint
CLS
0
Cumulative Layout Shift
TBT
0ms
Total Blocking Time
SI
16.1s
Speed Index
Powered by Google PageSpeed Insights · Mobile strategy · Scores: 90-100 Good 50-89 Needs Work 0-49 Poor
Related Infrastructure & Reports
Same registrar: 10dencehispahard, S.L 1
Recent threat reports 6
Recently added threat reports.
Were You Affected by This Site?
If credentials were compromised, report immediately. Do not engage with recovery scammers.
If credentials, payment data, or files were exposed, report the incident immediately. Change affected passwords, revoke active sessions, and scan the device.
Action Fraud
Report fraud and cybercrime in England, Wales and Northern Ireland
Contact centre0300 123 2040
PhishDestroy listing review Not a law-enforcement report
Domain Appeal
Request a review if you own this domain and believe the listing is incorrect
Beware of recovery scammers! Recovery scammers may pose as investigators, lawyers, or tracing services. Do not pay upfront fees or disclose credentials. Learn more about recovery fraud →
Report to Your Local Authorities
Select your country to get official cybercrime contacts, or create a complaint draft →.
97-country directory
Template-based draft • optional AI wording assistance requires separate consent
Review and submit it yourself
Check Any Domain
Threat analysis using stored blocklist, WHOIS, DNS, and public scan evidence
Scan NowReport Phishing
Submit suspicious domains to our threat database — protect the community
ReportLive Threat Feed
Recent phishing reports and observed availability changes
MonitorStay Informed, Stay Safe
Monitor live threats or contest this listing if you believe it's a false positive
