tonfor[.]com

tonfor.com is currently offline but historical data indicates it was used for a generic phishing campaign. The domain was registered on 21 February 2026 through NiceNIC International Group Co., Limited and pointed at the Cloudflare‑owned address 104.21.48.1, located in the United States under ASN 13335. No TLS certificate was observed, meaning the site served HTTP only. The page title returned by the web server was “TonFOR”, providing no clear indication of the targeted brand or service.

The domain appears on three independent phishing blocklists – PhishDestroy, ScamSniffer and Enkrypt – all of which classified it as a phishing source. VirusTotal analysis shows that 12 of 93 scanned security engines flagged the domain, reinforcing the suspicion of malicious intent. Nameserver records list “expired-ns1.niceisp.com” and “expired-ns2.niceisp.com”, which are typical of disposable or low‑reputation hosting configurations. The combination of recent registration, lack of SSL, association with Cloudflare’s shared IP, presence on multiple blocklists, and multiple vendor detections suggests a high‑risk phishing infrastructure, even though the site is no longer reachable.

Uncertainty remains regarding the specific credential‑capture technique, the exact victim demographic, and whether the domain was part of a larger campaign. Defenders should continue to block the domain at perimeter devices, monitor DNS queries for the IP 104.21.48.1 and associated nameservers, and add the indicator set to threat‑intel feeds. Ongoing observation of any re‑registration attempts or related sub‑domains is recommended to mitigate potential re‑use.