tokionlineislem[.]com

Analysis indicates that the domain tokionlineislem.com was registered on 5 November 2025 through Squarespace Domains LLC and is currently hosted on Cloudflare infrastructure (ASN 13335) with the IP address 104.21.51.38 located in the United States. The domain resolves to two Cloudflare name servers (adel.ns.cloudflare.com and armfazh.ns.cloudflare.com) and does not present an SSL/TLS certificate, leaving HTTP traffic unencrypted. The public web page that was observed before the site was taken offline displayed the title “Yüzyılın Konut Projesi”, which translates to “Century Housing Project”, suggesting a possible attempt to masquerade as a real‑estate offering, although no specific brand or legitimate site has been identified. Security‑vendor scans on VirusTotal recorded 16 positive detections out of 95 scanners, and the domain appears on one external blocklist.

It has also been referenced in sixteen AlienVault OTX pulses, indicating that multiple threat‑intel contributors have flagged it as malicious. PhishDestroy has listed the site as blocked, reinforcing the consensus that the domain is used for phishing or fraud. The Gridinsoft trust score of 0 out of 100 further reflects a high likelihood of abuse.

Because the site is currently offline, no additional content or credential‑harvesting mechanisms can be examined, and the exact phishing kit or victim‑targeting methodology remains uncertain. Defenders should immediately block or sinkhole tokionlineislem.com at the DNS and network layers, monitor for new domains registered by the same registrar or using the same Cloudflare name servers, and incorporate the observed indicators—such as the page title, IP address, and detection counts—into detection rules. Continuous observation of OTX pulses and blocklist updates is recommended to capture any re‑use of the infrastructure.