emrtoken[.]xyz

The domain emrtoken.xyz was registered through Dynadot Inc on 12 June 2026 and is currently flagged as high‑risk. VirusTotal analysis shows that 12 of 91 security vendors have classified the host as malicious, indicating a consensus of concern across multiple scanners. The site resolves to the Cloudflare‑managed address 172.67.197.158, which is associated with Cloudflare, Inc. in Canada. DNS resolution uses the Cloudflare name servers liz.ns.cloudflare.com and roan.ns.cloudflare.com, and the HTTP service is protected by a Google Trust Services / WE1 TLS certificate.

When accessed, the server returns HTTP status code 403 and the page title returned by Cloudflare is “Suspected Phishing | Cloudflare”, confirming that the endpoint is being treated as a phishing target by the origin network. The infrastructure advertises Cloudflare and HTTP/3 as the dominant technologies, which is typical for fast‑forwarding malicious sites. The domain appears on three public blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL, reinforcing the view that it is being used for brand‑impersonation phishing. The current status is listed as offline, so active content is not reachable for deeper forensic capture.

At present, no additional artifacts such as malware payloads, credential‑harvesting forms, or redirection chains have been disclosed. Consequently, certainty is limited to the observed network and reputation signals. Defenders should immediately add emrtoken.xyz to deny lists at network perimeter and endpoint protection layers, monitor for any DNS queries to the associated IP address, and watch for new sub‑domains or similar registrations that reuse the same registrar or Cloudflare name servers. Ongoing telemetry collection is recommended to capture any future re‑activation attempts, and threat‑intel feeds should be updated with the unique seed 877ed2 to preserve correlation across investigations.