bullcattoken[.]top

Analysis indicates that bullcattoken.top was registered on July 20 2026 via PDR Ltd and began resolving to the IPv4 address 188.114.97.3 within minutes of creation. The domain is delegated to Cloudflare’s authoritative name servers ali.ns.cloudflare.com and piers.ns.cloudflare.com, a common pattern for fast‑flux or short‑lived phishing infrastructure. Current threat intelligence flags the domain as high‑risk and confirms it remains active as of the report date, July 22 2026. Independent blocklists used by PhishDestroy, MetaMask and SEAL have already added the domain to their deny lists, and the domain appears on three additional security blocklists, indicating rapid community response.

A VirusTotal scan involving 95 antivirus engines has been performed; while none of the scanners currently label the host as malicious, the absence of detections does not constitute validation and should be interpreted as a lack of coverage rather than safety. No public SSL certificate details, HTTP response codes, or page‑title metadata have been disclosed, so the visible content and any credential‑harvesting behavior remain unverified. The limited visibility on the surface layer means that defenders should rely on the network‑level indicators – the IP address, Cloudflare name servers, and blocklist entries – to pre‑emptively block traffic to the domain.

Organizations using web filtering, DNS sinkholing, or endpoint protection should add the domain and its resolved IP to their deny lists. Continuous monitoring of the IP reputation and periodic re‑scans with VirusTotal or similar services are recommended, as the hosting provider may repurpose the address for future campaigns. Given the recent creation date and the swift appearance on multiple blocklists, the domain is likely part of an automated phishing kit, and proactive denial is the most effective mitigation.