token-flipperz[.]com

This domain, token-flipperz.com, is flagged as an active brand impersonation threat targeting Discord users, with a high-risk classification as of July 12, 2026. Infrastructure analysis reveals the domain was registered on February 21, 2026, through MAT BAO CORPORATION and currently resolves to IP 188.114.97.3, hosted on Cloudflare's network (AS13335). The page title, 'Flipper Zero — Portable Multi-tool Device for Geeks,' suggests an attempt to lure users with a fake hardware product offer, likely exploiting Discord's community interest in tech gadgets. The domain returns an HTTP 403 status, indicating access is restricted, which may be a deliberate tactic to evade automated detection or analysis. Nameservers are Cloudflare-hosted, and the SSL certificate is issued by Google Trust Services, providing a veneer of legitimacy while obscuring the true origin. Five security vendors on VirusTotal have flagged the domain, though the specific nature of these detections remains unconfirmed. The domain appears on one security blocklist, specifically PhishDestroy. Defenders should treat this domain as malicious, given its association with brand impersonation, recent registration, and Cloudflare-based hosting, which is frequently abused for phishing infrastructure. Immediate blocking at the DNS or network level is recommended, alongside monitoring for related domains using similar naming conventions or infrastructure patterns. Further investigation into the hosting provider's logs may reveal additional linked domains or campaigns, though Cloudflare's proxy complicates attribution efforts.