toescoin[.]xyz

This domain, toescoin.xyz, is flagged as a high-risk generic phishing threat and remains active as of the report date. Domain registration occurred on July 22, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar associated with a higher proportion of malicious registrations. The domain uses Cloudflare nameservers (decker.ns.cloudflare.com and harleigh.ns.cloudflare.com) and resolves to IP 104.21.32.66, which is within Cloudflare's hosting range. VirusTotal analysis shows 4 out of 91 security vendors flagging the domain as malicious, indicating a moderate detection rate among scanning engines.

The domain appears on one security blocklist and is blocked by the PhishDestroy service. Google Safe Browsing status is not specified, and no additional threat intelligence platform results (such as OTX or AlienVault) are available for this domain. The exact page content and brand targeting have not been analyzed, so the specific phishing lure or impersonated entity remains unknown.

Defenders should treat this domain as actively hostile, block all traffic to toescoin.xyz at the network perimeter, and monitor for any related subdomains or similar registrations using the same registrar or IP range. Users who may have interacted with the domain should be advised to change credentials and scan for unauthorized access. Given the generic phishing classification and the low but present vendor detection, this domain warrants immediate blocking and further investigation into its hosting infrastructure.