tokonama[.]com

The domain tokonama.com was registered on 17 April 2026 through the registrar 10dencehispahard, S.L. The registration is recent and the domain resolves to the IPv4 address 185.66.41.219, which is geolocated to Spain and associated with the same registrar. The nameserver set includes ns1.cdmon.net, ns2.cdmon.net, ns3.cdmon.net, ns4.cdmondns-01.org, and ns5.* (truncated). The website currently returns HTTP status code 200 and presents the page title “Alojamiento activo”.

TLS is provided by a Let’s Encrypt certificate (R13) that is valid for the domain, indicating that encrypted connections are available. The presence of a valid certificate does not mitigate the risk of credential harvesting, as the underlying content can still be malicious. The site’s content has not been flagged by VirusTotal (0 detections out of 95 engines), but the absence of detections should not be interpreted as a safety signal.

Threat intelligence sources have identified tokonama.com on a single security blocklist and it appears in one AlienVault OTX pulse. The domain has a Gridinsoft trust score of 0 out of 100, reinforcing the suspicion of malicious intent. Additionally, the domain is listed as blocked by the PhishDestroy blocklist, which specializes in phishing‑related infrastructure. These independent observations converge on a classification of generic phishing.

Uncertainty remains regarding the exact phishing campaign payload, the lure used, and the target audience. No public samples of the landing page have been shared, and the short lifespan of the domain limits historical analysis. Defenders should treat tokonama.com as malicious, enforce network‑level blocks for the domain and its resolving IP, and monitor DNS queries for related subdomains. Email security gateways should be tuned to flag messages that reference the domain or its URL patterns, and incident response teams should collect any credential submissions for further forensic examination.