bullcattoken[.]info

Analysis as of July 26 2026 indicates that the domain bullcattoken.info was registered on July 22 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently active. The authoritative name servers are athena.ns.cloudflare.com and byron.ns.cloudflare.com, pointing to Cloudflare’s DNS infrastructure. DNS resolution returns the IPv4 address 188.114.97.3. The same IP address is observed on three independent security blocklists, and the domain is explicitly listed by PhishDestroy, MetaMask, and SEAL as a malicious indicator.

VirusTotal reports that five of ninety‑one scanned security vendors have flagged the domain, confirming that a minority of AV engines have identified malicious behavior associated with the host. The classification supplied by the intelligence source is “generic phishing,” and the risk rating is high. No additional telemetry such as SSL certificate details, HTTP response codes, page titles, or content analysis is available, leaving the precise phishing vector and targeted brand undefined. Defenders should block network traffic to 188.114.97.3, add bullcattoken.info to DNS‑based deny lists, and monitor for any outbound connections attempting to resolve the domain.

Endpoint detection solutions should be configured to treat the five vendor detections as suspicious and generate alerts for any process that contacts the domain. Continuous re‑scanning on VirusTotal and periodic checks of the three blocklists are recommended to capture any changes in detection coverage. Until further content analysis is performed, the domain should be assumed hostile and treated as a high‑confidence phishing indicator.