toys24[.]vip

Analysis of toys24.vip indicates a recently established domain exhibiting multiple indicators of phishing infrastructure. Registered on February 23, 2026, through NiceNIC International Group Co., Limited, the domain currently resolves to 188.114.96.3, an IP address assigned to Cloudflare, Inc. (AS13335) in the United States. The domain is configured with Cloudflare nameservers (agustin.ns.cloudflare.com and romina.ns.cloudflare.com), a common tactic to obscure hosting origins and evade detection. No SSL certificate is present, which is atypical for legitimate e-commerce or consumer-facing sites but consistent with low-effort phishing deployments.

The domain appears on at least one security blocklist, specifically PhishDestroy, and is assigned a trust score of 0/100 by Gridinsoft, further supporting its classification as malicious. At the time of assessment, the domain is offline, displaying only the page title 'Just a moment...', which is characteristic of Cloudflare interstitial pages or newly deployed phishing kits awaiting activation. One of ninety-three security vendors on VirusTotal has flagged the domain, though the absence of broader detection does not preclude its malicious nature, particularly given its recent registration and lack of legitimate use history. Infrastructure analysis reveals no evidence of brand impersonation or specific scam categorization beyond generic phishing.

The domain name itself does not correspond to a known consumer brand, and no page content beyond the title has been analysed. Defenders should treat this domain as active phishing infrastructure, particularly given its use of Cloudflare to mask backend hosting. Network-level blocking at the IP and domain level is recommended, alongside monitoring for re-activation or shifts in hosting. The short lifespan and lack of SSL suggest the domain may have been part of a larger, disposable phishing campaign.