toacoin[.]com

The domain toacoin.com was registered through NameCheap, Inc. on June 26, 2022 and is delegated to the Cloudflare nameservers ace.ns.cloudflare.com and jill.ns.cloudflare.com. DNS resolution points to IP address 104.21.32.126, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site operated with a TLS certificate issued by Google Trust Services under the WE1 label, confirming a valid HTTPS endpoint, and the infrastructure advertised Cloudflare and HTTP/3 capabilities. The only captured page title reads “Buy & Sell Bitcoin, Ethereum | Cryptocurrency Exchange | Toacoin”, and the domain was classified as a crypto‑scam that impersonates the Ethereum brand. VirusTotal scans indicate that four of ninety‑five security vendors flagged the domain, and AlienVault OTX has referenced it in two separate threat‑intel pulses. Reputation data includes a Gridinsoft trust score of 1 / 100, placement on one security blocklist, and a block by the PhishDestroy filter. An HTTP request returns a 404 status code, and as of July 22 2026 the infrastructure has been taken offline.

Evidence suggests that the domain was used to lure victims with a cryptocurrency exchange façade targeting Ethereum‑related interests, but the current offline state prevents direct observation of malicious payloads, credential‑harvesting forms, or payment‑drain mechanisms. The low trust score, multiple vendor detections, and explicit OTX citations point to a deliberate fraud campaign rather than incidental misuse. Uncertainty remains around the exact landing‑page content, user‑interaction flow, and any associated binaries because the site no longer serves pages.

Defenders should add tourl filtering rules that deny any inbound or outbound traffic to toacoin.com, monitor DNS logs for re‑registration or resurrection attempts, and ensure endpoint protection solutions are updated to incorporate the four VirusTotal detections.