giggletoken[.]lol

The domain giggletoken.lol was registered on October 13, 2025 through Web Commerce Communications Limited and currently resolves to the IPv4 address 104.20.19.96. The IP belongs to AS13335 Cloudflare, Inc., placing the hosting infrastructure in the United States. DNS resolution is handled by the Cloudflare authoritative nameservers crystal.ns.cloudflare.com and matt.ns.cloudflare.com, indicating the site was protected by Cloudflare's reverse‑proxy service at the time of observation. No TLS certificate was presented; the HTTP response was delivered without HTTPS, which is consistent with the reported offline status.

The page title returned by the server was "Nur einen Moment…", a German phrase meaning "Just a moment…", but the content of the page has not been captured and therefore cannot be analysed for visual or functional cues. Threat intelligence flags the domain as a crypto‑related scam, and four of ninety‑five VirusTotal scanners generated a detection, leading to inclusion on a single public blocklist and a block by the PhishDestroy service. Gridinsoft assigned a trust score of zero out of one hundred, reinforcing the malicious assessment. The limited detection coverage and the recent creation date suggest a short‑lived campaign that was taken offline before broader propagation could occur.

Uncertainties remain regarding the exact phishing kit used, the specific cryptocurrency addresses or wallets targeted, and any victim interaction logs, as no landing page content or network traffic has been collected. Defenders should continue to monitor the IP address 104.20.19.96 for any re‑use in future malicious campaigns, enforce outbound filtering for domains resolving to Cloudflare edge nodes that lack a valid TLS certificate, and ensure that security appliances reference the current blocklist entries that include giggletoken.lol. Adding the domain to internal deny lists and sharing the indicator with threat‑sharing communities will help prevent resurgence.