tonkeep[.]sale

tonkeep.sale is currently listed as an active high‑risk generic phishing site. The domain was registered on February 21 2026 through Eranet International Limited and has been observed operating under the page title “Tonkeeper | Cashback Spread”. No additional content analysis is available, but the title suggests an attempt to impersonate the Tonkeeper brand. The underlying infrastructure points to Amazon Web Services, as the sole A record resolves to 76.76.21.241, which belongs to AS16509 (Amazon.com, Inc.) and is located in the United States. The domain uses the public‑suffix nameservers ns1.eranet-dns.com and ns2.eranet-dns.com. HTTPS is provided by a Let’s Encrypt certificate (R12), and the HTTP response code returns a 307 temporary redirect, indicating an active web service that may forward victims to additional malicious resources. Threat intelligence sources have begun to surface. The domain appears on one public blocklist and is actively blocked by PhishDestroy. VirusTotal reports that 2 of 95 scanned security vendors flag the domain, while Gridinsoft assigns a trust score of 0 / 100, reinforcing the high‑risk assessment. These signals collectively confirm that the domain is being used for phishing‑related activity, even though the exact payload has not been publicly released. Defenders should prioritize immediate mitigation. Network perimeter controls ought to block DNS resolution for tonkeep.sale and any associated IP address 76.76.21.241. Email gateways should be updated to flag URLs containing the domain. Continuous monitoring of outbound traffic to the AS16509 range can help detect compromised hosts that may be contacting the site. Incident response teams are advised to incorporate the domain and its redirect behavior into their URL‑reputation feeds and to share indicators of compromise with peer organizations.