tokeneex[.]top

Analysis of tokeneex.top shows a high‑risk phishing infrastructure that remains active as of July 19, 2026. The domain resolves to the Cloudflare‑hosted address 188.114.97.3, which is listed in the CA region under CloudFlare, Inc. Registration was performed through Gname.com Pte. Ltd., and the authoritative nameservers are ollie.ns.cloudflare.com and viddy.ns.cloudflare.com. HTTP requests return a 200 status code, while the page title is reported as "403 Forbidden," indicating the site may be configured to block direct access or serve content only under specific conditions. The TLS certificate is issued by Let’s Encrypt (entity YE1), confirming the use of a free, automated certificate. Threat intelligence sources have identified the domain in four AlienVault OTX pulses and six of ninety‑one VirusTotal scanners have flagged it as malicious. It appears on three public blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL. Concrete evidence points to a phishing operation, but the exact payload or credential‑harvesting page has not been publicly disclosed, leaving the specific lure and target audience uncertain. Defenders should immediately block the domain and its resolving IP at perimeter firewalls, update endpoint and browser security policies to include the listed blocklists, and monitor for any changes in HTTP response or certificate renewal that could indicate a shift in activity. Continuous telemetry from DNS and web proxy logs is recommended to detect any residual or related traffic.