# tonfor.com — MALICIOUS

> Warning: tonfor.com is a high-risk phishing site. Avoid interaction as it is flagged by multiple security sources and currently offline.

## Summary
PhishDestroy identifies tonfor.com as a high-risk phishing domain posing a generic phishing threat. Users should be cautious as this domain attempts to deceive visitors to steal sensitive information.

The domain was flagged on three security blocklists and is detected by 12 of 95 VirusTotal security vendors. Registered through NiceNIC International Group Co., Limited, tonfor.com was created on February 21, 2026, and resolved to IP 104.21.48.1 during its active period.

Currently, tonfor.com has been taken offline, mitigating immediate risk. Users are advised to avoid any interaction with this domain and ensure their security software is up to date to prevent exposure to phishing attacks.

## Threat Details
- Verdict: MALICIOUS
- Site status: dead (HTTP 0)
- Page title: TonFOR

## Domain Intelligence
- Registered: 2026-02-21 07:01:08
- Registrar: NiceNIC International Group Co., Limited
- Country: HK
- IP: 104.21.48.1
- IP Country: US
- IP City: San Francisco
- IP Org: AS13335 Cloudflare, Inc.
- Nameservers: ["expired-ns1.niceisp.com", "expired-ns2.niceisp.com"]
- SSL Issuer: none

## Detection Status
- VirusTotal: 12 vendors flagged
  Vendors: ["alphaMountain.ai", "BitDefender", "CRDF", "CyRadar", "ESET", "Forcepoint ThreatSeeker", "Fortinet", "G-Data", "Kaspersky", "Lionic", "Sophos", "Webroot"]
- Google Safe Browsing: clean
- Blocklists: 3 hits
  Lists: ["PhishDestroy", "ScamSniffer", "Enkrypt"]

## Evidence
- Screenshot: https://urlscan.io/screenshots/0198b897-30d3-718c-bfc5-b86f51827a0e.png
- PhishDestroy: https://phishdestroy.io/domain/tonfor.com/
- LLM endpoint: https://phishdestroy.io/domain/tonfor.com/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/tonfor.com/
Last updated: 2026-03-19