tokcbss[.]shop

Analysis of tokcbss.shop shows it is currently active and hosted behind Cloudflare infrastructure (nameservers lilith.ns.cloudflare.com and vicente.ns.cloudflare.com). The domain resolves to IP 172.67.162.249, which is geo‑located to Canada and belongs to Cloudflare, Inc. The site was registered on April 21, 2026 via GoDaddy.com LLC and presents a Let's Encrypt certificate (E7) with a valid HTTPS response (HTTP 200). The page title returned is the garbled string "没有找到站点", and no additional content has been publicly analysed. Google Safe Browsing classifies the URL under the SOCIAL_ENGINEERING category, and VirusTotal reports 20 of 94 security vendors flagging the domain. Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on one security blocklist and one AlienVault OTX pulse. PhishDestroy also blocks the host. The observed technologies include Cloudflare Browser Insights, Cloudflare services, and HTTP/3. While the infrastructure and threat intelligence indicate a high‑risk credential phishing operation, the exact phishing payload or targeted brand remains unknown. Defenders should block DNS resolution to tokcbss.shop, add the domain to web‑filter deny lists, monitor outbound traffic for connections to 172.67.162.249, and ensure endpoint protection solutions are updated to recognize the 20 vendor detections. Continued telemetry collection is advised to capture any evolving indicators of compromise.