get-or-sell-toncoin[.]net

The domain get-or-sell-toncoin.net was registered on February 21, 2026 through NiceNIC International Group Co., Limited and is currently reported as taken offline. Technical resolution points to the IP address 188.114.97.3, which is hosted in the United States under ASN 13335 owned by Cloudflare, Inc. The domain is served by the Cloudflare nameservers terry.ns.cloudflare.com and ximena.ns.cloudflare.com, but it lacks an SSL/TLS certificate, indicating that any HTTP traffic would be unencrypted. The observed page title, "Buy TON Coin - Fast, Scalable Cryptocurrency | The Open Network," suggests an attempt to lure victims with a cryptocurrency offer, consistent with the generic phishing classification.

Threat intelligence shows the domain appears on three security blocklists and is specifically blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal analysis recorded two detections out of ninety‑five scanners, confirming that at least a minority of AV engines flagged the domain as malicious. No additional behavioral data, such as payload samples or C2 communications, is publicly available, leaving the exact phishing workflow uncertain.

Defenders should continue to block the domain at perimeter controls, update DNS filtering policies to include the listed blocklists, and monitor the hosting IP for any future re‑use. Absence of TLS should be considered a risk indicator, and any attempts to resolve the domain should be logged for correlation with credential‑phishing events. Continuous re‑scanning of the domain when it reappears online is advised to capture any changes in detection scores or new malicious content.