tokikonut[.]net

Analysis indicates that the domain tokikonut.net was registered on October 12, 2025 through Squarespace Domains LLC. The authoritative name servers are ns-cloud-e1, ns-cloud-e2, and ns-cloud-e3.googledomains.com, which are Google Cloud DNS endpoints. DNS resolution points to IP address 196.251.81.228, an address listed in the United States and associated with the hosting provider Internet Secuirty Cheapyhost. Google Safe Browsing classifies the domain as a social engineering threat, and PhishDestroy has added it to its blocklist. AlienVault OTX reports the domain in fifteen separate threat‑intelligence pulses, indicating repeated observation across multiple feeds.

VirusTotal analysis shows that sixteen of ninety‑three scanning engines flagged the domain, reinforcing the malicious assessment. The domain also appears on one additional security blocklist. Current network probing confirms that the site is taken offline, and no HTTP response or SSL certificate data is available for further inspection. The lack of visible page content or title means that the specific phishing landing page cannot be described at this time.

Taken together, the convergence of multiple independent detections—Google Safe Browsing, PhishDestroy, OTX pulse count, and a multi‑engine VirusTotal flagging—supports a high‑risk classification for tokikonut.net despite its offline state. Defenders should continue to block the domain at perimeter filters, monitor for any re‑hosting of the same IP address, and update intrusion‑detection signatures with the observed indicators. Additional investigation is warranted if the domain becomes reachable again, at which point HTTP headers, certificate details, and page content should be captured for correlation with known phishing kits.