confidentaltoken[.]com

On July 24, 2026, the domain confidentaltoken.com was observed hosting a page titled “Portfolio • Confidential Token Manager”. The site has been taken offline, but historical artifacts indicate it was used as a crypto‑related phishing front. Registration data shows the domain was created on 12 December 2025 and was registered through NiceNIC International Group Co., Limited. DNS resolution points to the IP address 188.114.96.3, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. No TLS certificate was present at the time of capture, meaning the site operated over plain HTTP. The domain is listed on five independent security blocklists, specifically PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura, confirming that multiple anti‑phishing feeds have flagged it.

VirusTotal scanned the site and 7 of 95 security vendors returned a malicious classification, reinforcing the suspicion of malicious intent. AlienVault OTX includes the domain in a single threat‑intel pulse, providing additional community corroboration. A Gridinsoft trust score of 0 out of 100 further reflects the low reputation of the host. The page title suggests an attempt to present a “Confidential Token Manager” interface, aligning with the observed “Crypto Scam” label in the intelligence. Nameservers anirban.ns.cloudflare.com and cass.ns.cloudflare.com are standard Cloudflare resolvers, offering no additional attribution. Uncertainty remains around the exact phishing kit or credential‑harvesting mechanisms, as the site content has not been archived in detail.

No evidence of redirects, form fields, or payloads has been released publicly. Consequently, analysts cannot confirm whether the domain was used to exfiltrate private keys, solicit payments, or merely display fraudulent information.