tokenvest[.]online

Analysis of tokenvest.online, created on 21 February 2026 and hosted on Amazon’s AS16509 infrastructure, shows a clear pattern of brand impersonation targeting Binance. The domain is registered through NameCheap, Inc. and uses the generic registrar-servers.com name-servers. No TLS certificate is presented, meaning the site would have been served over plain HTTP if accessed. The page title returned by the host is "TokenVest", which aligns with the listed scam type of a crypto scam.

Threat intelligence sources have flagged the domain: AlienVault OTX includes it in one pulse, and VirusTotal reports six of ninety-three scanning engines marking it as malicious. Gridinsoft assigns a trust score of zero out of one hundred, indicating extreme suspicion. The domain appears on four external blocklists and is actively blocked by PhishDestroy, Polkadot, Enkrypt, and Codeesura. The infrastructure analysis reveals the sole IP address 16.170.242.29 located in Sweden, owned by Amazon.com, Inc., a common hosting provider for illicit actors due to its scale and anonymity.

Although the site is currently offline, the combination of brand impersonation, lack of encryption, low trust scores, and multiple blocklist entries suggests a high likelihood of malicious intent. Defenders should add tokenvest.online to internal deny-list rules, monitor DNS queries for the associated IP and name‑servers, and ensure that any outbound connections to the domain are blocked. Continuous hunting for related indicators—such as the IP address, the registrar-servers.com name‑servers, and the "TokenVest" page title—will help detect any re‑hosted variants. Because the domain’s hosting environment is shared, future campaigns may reuse the same IP or registrar, so threat‑intel feeds should be consulted regularly for updates.