ponstoken[.]live

Analysis Date: July 31, 2026. The domain ponstoken.live was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and created on July 28, 2026. It uses Cloudflare name servers mckenzie.ns.cloudflare.com and seth.ns.cloudflare.com and resolves to the IPv4 address 216.198.79.1. The domain is currently listed on a single security blocklist and has been actively blocked by PhishDestroy, indicating that threat‑intel feeds have identified it as malicious. VirusTotal scans show that 7 of 91 security vendors have flagged the domain, providing additional corroboration of its malicious nature.

The domain is classified as a generic phishing campaign with a high risk rating and remains active at the time of reporting. Available intelligence does not include a page title, SSL certificate details, HTTP response codes, Safe Browsing verdicts, or any associated campaign identifiers such as OTX or known phishing kits. Consequently, the specific content hosted on the site and the precise victim‑targeting technique cannot be confirmed at this stage. The presence of Cloudflare name servers is common among malicious infrastructures and does not, by itself, imply benign behavior.

Defenders should immediately add ponstoken.live to outbound and inbound filtering rules, enforce DNS sinkholing where possible, and monitor network traffic for connections to 216.198.79.1. Continuous re‑scanning of the domain with multiple sandbox and URL‑reputation services is advised to detect any changes in payload or hosting. Organizations employing email gateways should treat any messages containing links to this domain as malicious and quarantine them. Because the domain is newly created, rapid propagation is plausible; therefore, threat‑intel sharing platforms should be updated with the observed indicators of compromise to accelerate community response.