# PhishDestroy threat dossier — tonshop.shop ================================================================ Fetched: 2026-05-20 15:55:02 UTC Canonical: https://phishdestroy.io/domain/tonshop.shop/ ## VERDICT ---------------------------------------------------------------- ACTIVE + CLOAKED — returns HTTP 666 to scanners, real fraudulent site to victims Composite threat score: 90/100 (PhishDestroy scoring — see methodology below) Cloaking: DETECTED — domain returns custom HTTP 666 to scanners while serving fraudulent content to real users (type: content_split) (score: 1/6) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 2/92 security vendors flagged this domain ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 64.29.17.65 (US, Walnut) ASN: AS16509 Amazon.com, Inc. Hosting org: Vercel, Inc Registrar: HOSTINGER operations, UAB Nameservers: ["ns2.vercel-dns.com", "ns1.vercel-dns.com"] Registered: 2026-05-07 Page title: FlashShop Tonkeeper/TonSpace | Buy Tokens ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / R12 Expires: 2026-08-04 Status: INVALID chain Fingerprint: 86adf3b6a241f91dfc65dfd80a87ac2943279998e2e641b19a8625cbec445aaf ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-05-07 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-05-07 04:25:43 UTC (by PhishDestroy tracker) Earliest abuse rec: 2026-05-07 01:26:48 UTC — PREDATES current WHOIS registration; retained from a previous registration cycle of the same domain name Last verified: 2026-05-17 01:40:08 UTC Neutralised: 2026-05-15 01:33:21 UTC Current status: ACTIVE — cloaked behind HTTP 666 to evade scanners Note: one or more events above predate the WHOIS creation date. This typically means the same domain name was previously registered, detected, dropped, and then re-registered by a new party. PhishDestroy preserves the full historical record for operator-attribution research even when the underlying infrastructure changes hands. ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019e0009-a111-7506-a69e-b175ad738320/ URLQuery: https://urlquery.net/report/5cca3d33-077a-4468-be07-81733c8f7e2c Wayback Machine: https://web.archive.org/web/*/tonshop.shop crt.sh CT logs: https://crt.sh/?q=%25.tonshop.shop Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=tonshop.shop AlienVault OTX: https://otx.alienvault.com/indicator/domain/tonshop.shop URLhaus: https://urlhaus.abuse.ch/host/tonshop.shop/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-05-07 04:26:14 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] tonshop.shop has been flagged as an active phishing domain designed to mimic legitimate online storefronts, potentially harvesting credentials or payment data from unsuspecting visitors. Security teams initially detected this domain via automated feeds and rapid pivoting off newly registered suspicious domains, revealing a low initial detection rate that suggests it has evaded broader scrutiny. This site currently resolves to IP address 64.29.17.65 and uses a Let's Encrypt SSL certificate, a common tactic to lend false legitimacy to malicious pages. Given its active status and lack of detection by 95 security vendors at the time of discovery, this domain represents a credible threat to users who may enter sensitive information in response to fake promotions or “limited-time offers.” This phishing operation poses a direct risk to privacy and financial security by impersonating a retail platform. Rather than promoting legitimate goods, the domain likely serves as a front for credential harvesting or credit card skimming, collecting user input through fraudulent login and checkout forms. The absence of detections on VirusTotal—currently 0 out of 95 engines—indicates that major antivirus or URL filtering platforms have not yet integrated detection rules for this exact domain or its patterns. The domain’s infrastructure, including its reliance on a public IP (64.29.17.65) and free SSL issuance, further highlights its opportunistic nature, leveraging low-cost resources to avoid immediate blacklisting while maintaining plausible deniability. While the domain is under active investigation, the lack of immediate detection increases the likelihood of successful user compromise during this window of exposure. We know this domain is newly active and unflagged based on several technical indicators. VirusTotal currently reports zero detections across all participating engines, despite active scanning enabled on the domain. While specific creation date and registrar details are not included in the intelligence feed, such domains are typically registered within the last 30 days and utilize privacy-protected or newly established registrars to delay takedown efforts. The use of a Let’s Encrypt certificate suggests the operators prioritize quick deployment over long-term persistence, likely planning rapid rotation if the domain is reported. This combination of fresh registration, zero detections, and low-cost hosting infrastructure points to a fledgling but potentially high-volume phishing campaign targeting bargain-seeking users. If you have visited tonshop.shop or entered any credentials, passwords, or payment information, take immediate action: change all reused passwords and enable multi-factor authentication on affected accounts. Monitor financial statements closely for unauthorized transactions and consider freezing credit if payment details were shared. Report the domain to your organization’s SOC or to abuse channels at the hosting provider using IP 64.29.17.65. Avoid visiting the site again, and warn others who may encounter similar domains offering suspiciously low prices or urgent “limited stock” claims. Organizations should block this domain and IP at the network level and inspect DNS logs for further compromise. Stay vigilant against evolving phishing tactics that exploit urgency and price sensitivity—early detection and reporting are critical to preventing credential theft and fraud. ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260507-D5472E Favicon MD5: b855b4290b570db0978c414030d767f1 TLS cert SHA-256: 86adf3b6a241f91dfc65dfd80a87ac2943279998e2e641b19a8625cbec445aaf ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/tonshop.shop/ JSON API: https://api.destroy.tools/v1/check?domain=tonshop.shop Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 152,097 domains (43,122 alive under monitoring, 108,620 confirmed takedowns/dead). Site: https://phishdestroy.io