tokentrendings[.]live

Analysis of tokentrendings.live indicates that the domain was registered on March 03, 2026 through Hostinger operations, UAB. The authoritative nameservers are elle.ns.cloudflare.com and gerald.ns.cloudflare.com, pointing the domain to the Cloudflare edge address 172.67.213.88, which is announced by AS13335 and geolocated to the United States. No TLS certificate is presented, meaning the site would be served over plain HTTP if it were reachable. The page title returned by the server is “Dex Screener”, a term commonly associated with cryptocurrency tracking interfaces, and the intelligence classifies the activity as a crypto‑related scam.

VirusTotal has recorded detections from 2 of 94 scanning engines, confirming that at least a minority of security products flag the domain as malicious. Independent blocklist monitoring shows the domain listed on three public blocklists and it is explicitly blocked by the PhishDestroy, MetaMask, and SEAL filtering services, reinforcing the malicious assessment. The current operational status is offline, which prevents immediate verification of payloads or redirects, but historical evidence points to a phishing campaign targeting cryptocurrency users. Uncertainty remains regarding the exact content delivered when the site was live, the specific phishing kit employed, and whether any credential‑harvesting infrastructure was provisioned beyond the observed DNS configuration.

Defenders should continue to deny any network traffic to the IP address 172.67.213.88, enforce DNS sinkholing for the domain, and update intrusion detection signatures to include the observed nameserver and page‑title pattern. Monitoring of Cloudflare edge IP ranges for similar short‑lived domains is recommended, as well as periodic re‑scanning of the domain in case it is re‑activated. Organizations that allow connections to external cryptocurrency services should treat any request to tokentrendings.live as malicious and block it at the firewall or proxy level.