Analysis as of July 30, 2026 indicates that the domain pons.earn-token.fun was registered on July 29, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently resolving to the IP address 188.114.97.3. The domain is served by Cloudflare nameservers donald.ns.cloudflare.com and paris.ns.cloudflare.com. VirusTotal has processed the host with 91 antivirus and scanning engines; none have generated a detection.
The domain appears on a single public blocklist and is listed as blocked by PhishDestroy. No additional intelligence such as Safe Browsing status, OTX mentions, SSL certificate details, HTTP response codes, or page title information is available in the current dataset. Consequently, the exact nature of the phishing campaign, including the targeted brand or credential‑collection method, remains unknown.
The lack of detections does not imply benign intent, and the recent creation date suggests the infrastructure may still be in an early deployment stage. Defenders should consider proactively blocking the domain and its associated IP address at network perimeter devices, incorporate the host into threat intelligence feeds, and monitor for any future changes in detection status or additional sightings. Continuous re‑evaluation is recommended as further evidence becomes available.