tokenworks-vote-upcoming-rewards-date-treasury-pool-reward[.]pages[.]dev

This domain, registered through Cloudflare Pages on May 27, 2026, is actively flagged as a high-risk generic phishing threat targeting the TokenWorks brand. Analysis indicates the page title explicitly displays 'TokenWorks™', confirming brand impersonation tactics. The domain resolves to IP 188.114.96.3, hosted under Cloudflare, Inc. infrastructure in Canada, and presents a valid SSL certificate issued by Google Trust Services (WE1). Despite returning an HTTP 200 status, the domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, which classify it as malicious. No vendor detections were recorded at the time of scanning, though this absence does not confirm safety. The domain's creation date aligns with recent phishing campaign patterns, and its use of Cloudflare Pages infrastructure is consistent with threat actors leveraging free hosting services to evade detection. Defenders should treat this domain as an active threat, particularly given its presence on multiple blocklists and confirmed brand impersonation. Further analysis of the site's content or backend scripts was not conducted, so additional malicious functionality cannot be ruled out. Network-level blocking or monitoring of connections to 188.114.96.3 is recommended for mitigation.