tptokenex[.]cc

The domain tptokenex.cc remains active as of July 19, 2026 and is classified as a generic phishing host. Infrastructure analysis shows it is registered through Gname.com Pte. Ltd. and resolves to the IP address 188.114.97.3, which belongs to CloudFlare, Inc. in Canada. The domain is served by the CloudFlare nameservers ollie.ns.cloudflare.com and viddy.ns.cloudflare.com and presents a valid Let’s Encrypt certificate (CN=YE2). Public threat feeds list the domain on three blocklists and record five detections out of 91 scanning engines on VirusTotal. AlienVault OTX contains five pulses that reference tptokenex.cc, indicating moderate community awareness. The HTTP response is reported as 200 OK, yet the page title returned is "403 Forbidden," suggesting that the site may be deliberately restricting access or is employing dynamic content delivery. No direct content analysis is available, so the exact phishing payload or lure is unknown. Defenders should treat the domain as malicious, enforce network-level blocking of the domain and its associated IP, and include it in email security and URL filtering rules. Continuous monitoring of CloudFlare‑hosted IP ranges for similar activity is advised, as is sharing indicators with upstream threat‑intel platforms to improve collective detection.