createtokens[.]io

This domain, createtokens.io, is flagged as an active crypto scam site as of July 12, 2026. Analysis indicates it was registered on February 21, 2026, through Porkbun LLC and currently resolves to 44.230.85.241, an IP address hosted on AWS EC2 in the US (us-west-2). The domain is listed on one security blocklist and is actively blocked by at least one threat intelligence provider. The page title, 'Vercel Security Checkpoint,' suggests an attempt to mimic a legitimate security verification process, though the exact content and functionality of the site remain unconfirmed. Infrastructure analysis reveals the use of Vercel hosting, Cloudflare for traffic routing, and HTTP/3 support, which may complicate detection or takedown efforts. The SSL certificate is issued by Let's Encrypt (R13), a common practice among both legitimate and malicious sites. Nameservers are hosted under Porkbun, consistent with the domain registrar. While only 2 of 93 security vendors on VirusTotal flag this domain, this does not indicate safety, as phishing domains often evade initial detection. Defenders should treat this domain as high-risk due to its active status, association with crypto scams, and presence on blocklists. Recommended actions include blocking the domain and IP at the network level, monitoring for related infrastructure (e.g., subdomains or newly registered domains under the same registrar), and alerting users to potential crypto-related fraud attempts. Further investigation into the site's backend or associated wallet addresses may provide additional indicators of compromise.