toolbox-c6r[.]pages[.]dev

Analysis of toolbox-c6r.pages.dev shows an active infrastructure that appears to be used for brand impersonation targeting Instagram. The domain was registered on March 27, 2026 through Cloudflare, Inc. and is served from Cloudflare’s network (IP 172.66.44.229, location Canada). Authoritative nameservers are beau.ns.cloudflare.com and davina.ns.cloudflare.com, indicating the domain is fully managed under Cloudflare’s DNS. HTTPS is enabled with a Google Trust Services / WE1 certificate and the site enforces HSTS. Detected technologies include Google Analytics, Cloudflare Browser Insights, HTTP/3, and standard Cloudflare edge services. The HTTP response returns status 200 and the page title reads “MyTool.Social | Free Online Image Cropper for Social Media – Instagram, TikTok, YouTube,” suggesting the site is positioned as a tool for social‑media content, while explicitly naming Instagram in the title. The domain is listed on a single security blocklist (PhishDestroy), confirming that at least one security vendor has identified it as malicious. VirusTotal scanned the site with 94 vendors and reported no detections, but this alone does not establish safety. Current evidence points to a likely attempt to lure Instagram users into a fraudulent workflow, possibly by offering a free image‑cropper that harvests credentials or redirects to malicious content. Defenders should block the domain at network perimeter, monitor DNS queries for the associated Cloudflare nameservers, and add the URL to URL filtering policies. Continuous monitoring of the domain’s activity and any changes to its hosting or certificate status is recommended, as the threat remains active and under investigation.