hedera[.]tokenops[.]xyz

Analysis of hedera.tokenops.xyz shows it was registered on June 29 2022 through Go Daddy, LLC and uses the default GoDaddy nameservers ns53.domaincontrol.com and ns54.domaincontrol.com. The domain does not present an SSL certificate, indicating traffic is served over plain HTTP. DNS resolution points to IP 216.150.1.193, an address owned by Amazon.com, Inc. (ASN 16509) and geolocated to the United States. The site has been classified as a crypto‑related scam and is listed as a generic phishing operation.

Detection services have flagged the domain: two of ninety‑five VirusTotal scanners reported malicious activity, and the domain is currently blocked by the PhishDestroy feed, appearing on one additional security blocklist. The operational status is recorded as offline, and the hosting provider has taken the site down. Evidence confirms that the domain is being used to lure victims into a cryptocurrency fraud, but the exact phishing payload, landing page content, or targeted brands have not been disclosed in the available data. Consequently, the full scope of the campaign—such as the number of victims, credential‑stealing techniques, or command‑and‑control infrastructure—remains uncertain.

Defenders should add hedera.tokenops.xyz to their deny‑list, monitor DNS queries for the associated IP address, and enforce HTTPS‑only policies to mitigate accidental connections. Network sensors should flag any outbound traffic to the listed IP or to the domain, even though the site is currently offline, because the infrastructure may be reused for future campaigns. Continuous ingestion of updated blocklists, including PhishDestroy, will ensure that any re‑appearance is promptly blocked.