toll-asflde[.]com

toll-asflde.com is a newly registered domain (created 27 January 2026) that has been observed hosting a brand‑impersonation campaign targeting Mastercard. The site resolves to the IP address 185.68.21.77, which is assigned to AS48347 JSC Mediasoft ekspert in Russia. The hosting infrastructure is flagged by PhishDestroy and appears on a single security blocklist; the domain is currently taken offline. SSL analysis shows the certificate labelled “E7”, indicating a low‑trust certificate.

Gridinsoft assigns a trust score of 0 / 100, and three of ninety‑three VirusTotal scanners have flagged the domain as malicious. The only visible page title returned during the brief crawl was “Startseite – SAWYER ARCHIE HUNTER”, which does not reference Mastercard and suggests the underlying content has not been publicly disclosed. Registration was performed through NICENIC INTERNATIONAL GROUP CO., LIMITED. The combination of a recent registration, Russian‑based IP, low trust scores, and multiple vendor detections aligns with typical infrastructure used for brand‑impersonation scams.

At present, no additional artifacts such as phishing kits, credential‑harvesting forms, or malicious payloads have been identified, leaving the exact attack vector uncertain. Defenders should block the domain and its resolving IP at perimeter defenses, monitor for any residual traffic, and add the indicator to internal threat‑intel feeds. Continuous re‑evaluation is advised in case the site is re‑activated or new samples appear in sandbox analyses.