checker[.]townsnetwork[.]xyz

The domain checker.townsnetwork.xyz was registered on 21 February 2026 and resolves to the IP address 172.67.221.252, which is owned by Cloudflare, Inc. (AS13335) and geolocated to the United States. The site presented a page titled “Towns Protocol” before being taken offline. Static analysis on VirusTotal shows that three of ninety‑three security vendors flagged the domain, indicating a modest level of detection across the scanning community.

Independent blocklist monitoring confirms that the domain appears on two commercial phishing blocklists and has been explicitly listed by PhishDestroy and ScamSniffer, further corroborating its malicious classification. Additional reputation data includes a Gridinsoft trust score of 0 / 100 and an SSL certificate labeled “WE1,” both of which are consistent with low‑trust, potentially spoofed infrastructure. The current HTTP status is offline, preventing live verification of content, but the combination of a recent creation date, Cloudflare front‑end, low trust scores, and multiple blocklist entries supports the assessment that the domain was used for a generic phishing campaign targeting users of the “Towns Protocol” service.

Uncertainties remain regarding the specific phishing vector, the credential collection mechanism, and any downstream command‑and‑control infrastructure, as no payload samples or URL paths have been captured. Defensive teams should continue to block the domain at network perimeters, update URL filtering policies to include the listed blocklists, and monitor for any re‑registration attempts or similar sub‑domains under the townsnetwork.xyz namespace. Incident response units should also consider querying additional sandbox services for any archived copies of the site to extract potential phishing templates or malicious scripts, and should share any new artifacts with threat‑intel sharing platforms to improve collective detection.