tokence[.]icu

Analysis indicates that the domain tokence.icu is actively serving a malicious web resource classified as generic phishing. The site presents an HTTP 200 response while the HTML title returned is “403 Forbidden”, suggesting the content may be dynamically generated or deliberately obscured. The domain is secured with a Let’s Encrypt certificate (issuer YE1) and is hosted behind Cloudflare infrastructure (IP 172.67.136.117, CA location). DNS is delegated to ollie.ns.cloudflare.com and viddy.ns.cloudflare.com. Registration information shows the registrar Gname.com Pte. Ltd. The domain appears in four AlienVault OTX pulses and is listed on three public blocklists. Seven of ninety‑one VirusTotal scanners have flagged the host, and it is already blocked by PhishDestroy, MetaMask, and SEAL. The available intelligence does not reveal the exact payload or targeted brand, and the page content has not been captured, leaving the specifics of the phishing lure unknown. Defenders should add tokence.icu to URL filtering and DNS sinkhole rules, monitor for any outbound connections to the associated Cloudflare IP, and consider sharing the indicator with threat‑sharing platforms. Continuous re‑inspection of the site is advised to capture any changes in content or additional malicious activity.