wojaktoken[.]net

Analysis of wojaktoken.net indicates a high-risk phishing domain active as of July 12, 2026. The domain was registered on January 5, 2026, through NiceNIC International Group Co., Limited, and currently resolves to IP address 188.114.97.3. Infrastructure analysis reveals the use of Cloudflare services, including HSTS and HTTP/3, as well as Google Trust Services for SSL certification, which may be leveraged to lend an appearance of legitimacy to the malicious site. The domain is flagged by 2 of 95 security vendors in available scans and appears on two security blocklists, including PhishDestroy and BLP-Malware. Additionally, it has been documented in 24 threat intelligence pulses on AlienVault OTX, suggesting ongoing or repeated malicious activity. The page title 'Un instant…' is consistent with temporary or transitional pages often used in phishing campaigns to evade detection or delay analysis. No specific brand impersonation or phishing kit has been confirmed at this time, and the exact nature of the phishing content remains unanalyzed. Defenders are advised to treat this domain as hostile and implement blocking measures at the network level. Given the use of Cloudflare and a valid SSL certificate, traditional indicators such as IP reputation may be less effective, and reliance on domain-based detection or threat intelligence feeds is recommended. The domain remains active, and further monitoring is warranted to assess any shifts in infrastructure or targeting behavior.