toffoli[.]ai

Analysis of the domain toffoli.ai, first registered on 12 May 2023 through GoDaddy.com, LLC, shows that it continues to resolve to the IP address 172.67.184.56 and is served by Cloudflare name servers damiete.ns.cloudflare.com and naya.ns.cloudflare.com. The domain is currently active and has been observed on a single security blocklist. It has also been listed by the PhishDestroy service, indicating that at least one anti‑phishing feed is treating it as malicious.

A VirusTotal scan involving 95 independent scanning engines returned no detections at the time of the query; however, the absence of detections does not constitute a safety guarantee and should be interpreted in the context of other indicators. No additional public intelligence such as Safe Browsing, OTX, or SSL certificate anomalies has been supplied. Consequently, the confidence in the domain’s malicious intent rests primarily on its inclusion in the PhishDestroy feed and its appearance on a blocklist, combined with the typical characteristics of generic phishing infrastructure, such as the use of a Cloudflare‑protected IP address that can mask the true hosting location.

Defenders should add toffoli.ai to internal block and monitoring lists, enforce DNS‑level filtering, and consider correlating any outbound connections from internal hosts to the IP 172.67.184.56 with user‑reported phishing attempts. Continuous re‑evaluation is advised, as future scans may yield detections and additional threat‑intel sources could provide further context.