owltofi[.]com

Analysis of the domain owltofi.com indicates it is a confirmed phishing site targeting cryptocurrency users, currently offline as of July 24, 2026. The domain was registered on February 23, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains. It resolves to the IP address 188.114.97.3, hosted on Cloudflare's network (AS13335), a common infrastructure choice for phishing campaigns due to its privacy and resilience features. The domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, which specifically flag it as malicious.

Detection engines on VirusTotal show minimal coverage, with only 2 out of 93 vendors marking it as malicious, suggesting either limited exposure or evasion techniques. The SSL certificate is issued by Google Trust Services (WE1), which does not inherently indicate legitimacy due to the widespread use of free certificates in phishing operations. The page title, 'www.www.owltofi.com', is anomalous and may reflect misconfiguration or an attempt to evade automated detection systems. Nameservers are hosted under Cloudflare (cory.ns.cloudflare.com and megan.ns.cloudflare.com), further aligning with observed phishing infrastructure patterns.

Defenders should treat this domain as high-risk, particularly for users of cryptocurrency services, given the MetaMask blocklist inclusion. While the site is currently offline, historical DNS records and WHOIS data should be preserved for forensic analysis. No specific phishing kit or brand impersonation details are available from the provided data, so the exact nature of the scam (e.g., wallet drainer, fake token swap) remains unconfirmed. Organizations are advised to block the domain at the DNS level and monitor for any reactivation or related domains registered through the same registrar or hosting provider.