tofro[.]com

Analysis of tofro.com, created on 21 February 2026 and hosted behind Cloudflare (AS13335) at IP address 104.21.86.200, indicates a high‑risk generic phishing operation that remains active as of 24 July 2026. The domain resolves to a Cloudflare front‑end and does not present an SSL/TLS certificate, exposing traffic to potential interception. HTTP requests receive a 301 redirect response, suggesting an attempt to steer visitors to a secondary location or to mask the final landing page. Registration was performed through Name.com, Inc., and the authoritative nameservers are ns1hnx.name.com, ns2lns.name.com, ns3fhx.name.com, and ns4kmw.name.com, reflecting a typical fast‑flux or shared‑hosting configuration.

Threat intelligence shows the domain appears on one security blocklist and has been blocked by PhishDestroy, confirming that at least one anti‑phishing solution has identified it as malicious. AlienVault OTX reports a single pulse referencing tofro.com, providing additional community corroboration of its malicious nature. Reputation scoring from Gridinsoft assigns a low trust score of 10 out of 100, further indicating poor credibility.

VirusTotal scans reveal that three out of ninety‑three security vendors flagged the domain, demonstrating that multiple detection engines have observed suspicious activity associated with the host. Defenders should prioritize blocking the domain at network perimeters, enforce URL filtering based on the observed IP and nameserver set, and monitor for any outbound connections to the Cloudflare IP range that may be leveraged for credential harvesting. Continuous re‑scanning is advised, as the low trust score and partial vendor detections suggest that the threat may evolve or expand its infrastructure.