24toys[.]vip

Analysis of 24toys.vip indicates that the domain was registered on 24 February 2026 through NiceNIC International Group Co., Limited and is currently taken offline. The authoritative nameservers agustin.ns.cloudflare.com and romina.ns.cloudflare.com resolve the domain to IP address 188.114.96.3, which belongs to Cloudflare, Inc. (AS13335) and geolocates to the United States. No TLS certificate was observed for the host, meaning HTTPS connections would be negotiated without encryption, a common characteristic of hastily deployed phishing infrastructure. The sole HTML title returned by the site was “Just a moment…”, providing no insight into the intended victim‑facing content.

VirusTotal records show that two of ninety‑three scanning engines flagged the domain, confirming that at least a minority of automated analyses identified malicious behavior. The domain is listed on a single external blocklist and is actively blocked by the PhishDestroy service, indicating that threat‑intelligence feeds have already incorporated it. The limited detection count and blocklist presence suggest that the campaign may be in an early stage or that the operators have deliberately minimized exposure. Defenders should add 188.114.96.3 to network‑level deny lists and enforce DNS filtering for 24toys.vip, even though the site is presently offline.

Monitoring for re‑appearance of the domain or for new sub‑domains under the same Cloudflare nameservers is advisable, as threat actors frequently recycle infrastructure. Because the site lacks TLS, any accidental connection would expose credentials in clear text, reinforcing the need for strict outbound HTTPS inspection policies. Continuous review of threat‑intel feeds for additional detections or increased vendor consensus is recommended to adjust the risk posture as the campaign evolves.