tonbox[.]top

Analysis of the domain tonbox.top indicates that it was registered on August 11, 2024 through NiceNIC International Group Co., Limited and is currently offline. The authoritative name servers are paige.ns.cloudflare.com and pranab.ns.cloudflare.com, confirming that the domain is hosted behind Cloudflare’s network. DNS resolution points to IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated to the United States. The site presented the page title "TON Lucky" and employed Cloudflare Browser Insights and HTTP/3, suggesting an attempt to leverage modern web protocols for faster delivery.

TLS termination is provided by a Google Trust Services certificate identified as WE1, indicating a legitimate‑looking HTTPS configuration. Security telemetry shows that one of ninety‑five VirusTotal scanners flagged the domain, and three independent blocklist operators—PhishDestroy, ScamSniffer, and Enkrypt—have listed it, reflecting consensus that the site was used for phishing. The domain appears on three additional security blocklists, though the specific list names are not disclosed. No further technical artifacts such as malicious payloads, credential‑harvesting forms, or redirect chains have been captured, and the exact phishing lure beyond the generic "TON Lucky" title remains unverified.

Defenders should continue to block traffic to 188.114.96.3 and enforce DNS‑level deny rules for tonbox.top. Monitoring of Cloudflare‑associated IP ranges for similar patterns is advisable, as is periodic re‑scanning of the domain should it become active again. Incident response teams should treat any emails or messages referencing "TON Lucky" or the tonbox.top URL as potentially malicious and advise users to avoid interaction until the site’s status is clarified.