flocktoken[.]live

Analysis of www.flocktoken.live indicates the site was taken offline as of July 23, 2026 but retains observable artifacts that justify continued defensive attention. The domain is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to the Amazon Web Services address 64.29.17.65, belonging to ASN AS16509 operated by Amazon.com, Inc. The HTTP response returned status code 451, suggesting the server deliberately refused to disclose the requested resource. The TLS certificate is issued by Let’s Encrypt under the YR1 series, confirming the use of a freely‑issued certificate. Nameserver delegation points to seth.ns.cloudflare.com and mckenzie.ns.cloudflare.com, indicating Cloudflare DNS services.

The page title captured during the active period reads “Flockerz – Claim $FLOCK”, aligning with the classified scam type of Brand Impersonation. VirusTotal scans recorded three detections out of 91 vendors, and the domain is listed on a single security blocklist, including explicit blocking by PhishDestroy. The evidence collectively shows a typical infrastructure pattern for short‑lived impersonation campaigns that leverage reputable cloud providers and free SSL to increase perceived legitimacy.

Uncertainty remains regarding the specific phishing kit employed, any credential harvesting mechanisms, and whether additional mirrors exist under the same IP range. Defenders should continue to block the domain name and its resolved IP address at perimeter and DNS filtering layers, monitor for re‑registration, and consider adding the associated Cloudflare name servers to watchlists. Ongoing threat intelligence feeds should be queried for any resurgence of the same identifiers, and endpoint security solutions should retain the three VirusTotal detections as indicators of compromise for heuristic correlation.