toolscript[.]shop

toolscript.shop was registered on 21 February 2026 through Hostinger Operations UAB. DNS resolution points to 145.223.77.204, an address announced by AS47583 Hostinger International Limited and geolocated to the United States. The domain uses the public‑suffix nameservers ns1.dns‑parking.com and ns2.dns‑parking.com and presents a valid Let’s Encrypt R12 certificate, indicating that TLS termination was functional at the time of observation. The site’s HTML title reads “Toolscript.shop – BTC and USDT Flash SWAPPABLE and TRADABLE SOFTWARE DOWNLOAD”, a phrasing commonly employed to lure cryptocurrency users.

Intelligence tags the domain as a wallet/seed phishing operation that impersonates Coinbase, targeting users’ private keys or recovery phrases. Gridinsoft assigned a trust score of 1 out of 100, and the domain appears on a single security blocklist. VirusTotal recorded a single positive detection out of 93 scanning engines, and PhishDestroy has already blocked the host. As of the report date (22 July 2026) the site is taken offline, preventing direct payload analysis.

The limited visibility leaves the exact malicious payload, phishing page layout, and any associated command‑and‑control infrastructure unknown. Defenders should immediately add 145.223.77.204 to network deny lists, enforce domain‑based filtering for toolscript.shop, and monitor for newly registered domains that resolve to the same hosting provider or reuse the same page‑title pattern. Continuous observation of Hostinger‑hosted IP ranges for similar low‑trust scores is advised, as the infrastructure may be repurposed for future campaigns.