publicsale-toby[.]lat

This domain, publicsale-toby.lat, is identified as a high-risk phishing site. It is associated with a potential brand impersonation, specifically targeting users interested in token sales, which could indicate a fraudulent attempt to gather sensitive information such as login credentials or financial details.

Infrastructure analysis reveals that publicsale-toby.lat has been flagged by VirusTotal, with 15 out of 95 security vendors marking it as malicious. The domain is registered through PDR Ltd. d/b/a PublicDomainRegistry.com and resolves to the IP address 188.114.97.3. The domain was created on March 13, 2026, and it appears on 4 security blocklists, including but not limited to MetaMask, PhishDestroy, SEAL, and Maltrail. Technologies detected on the site include Bootstrap and Cloudflare services, which are commonly used for enhancing the appearance and performance of web pages but can also be leveraged to mask malicious activities.

The current status of the domain is offline, indicating that it has been taken down or no longer resolves to an active web server. Despite this, the presence of the domain on multiple blocklists and the high number of security vendor detections suggest that the threat once posed by publicsale-toby.lat was significant. Users are advised to remain vigilant and avoid any links or communications related to this domain. Security teams should continue to monitor for any signs of reactivation and ensure that endpoints and networks are protected against similar threats.