toksweb[.]xyz

The domain toksweb.xyz was registered on July 17 2026 via OwnRegistrar, Inc. and is currently resolving to 172.67.169.25 under the Cloudflare nameservers ligia.ns.cloudflare.com and steven.ns.cloudflare.com. Within three days of creation it appeared on three independent security blocklists and is listed as active by multiple sink‑hole feeds. VirusTotal records show that 2 of 95 scanned security engines flagged the domain, indicating at least partial malicious confidence. The domain is already blocked by PhishDestroy, MetaMask, and SEAL, confirming that defensive communities consider it hostile. No additional infrastructure details such as ASN or hosting country are disclosed in the available intelligence. Because the domain is newly created, its short lifespan suggests a rapid‑deployment phishing campaign, but the exact payload or targeted brand has not been observed. Defenders should add toksweb.xyz to URL filtering rules, enforce DNS blocklists that include it, and monitor outbound traffic for connections to 172.67.169.25. Continuous re‑evaluation is advised as further analysis may reveal additional indicators or victim reports.