tokencheckpoint[.]netlify[.]app

Analysis of tokencheckpoint.netlify.app indicates that the site was created on March 03, 2026 and is currently offline, returning an HTTP 404 status. The domain resolves to IP address 98.84.224.111, which is assigned to Amazon.com, Inc. (AS16509) and geolocated in Germany. The TLS certificate presented is issued by DigiCert Inc., specifically the DigiCert Global G2 TLS RSA SHA256 2020 CA1 chain, confirming the use of a legitimate certificate authority. The page title observed during the brief collection period was "О​р​е​n​Ѕ​е​a - NFT Marketplace," suggesting a targeting of users interested in non‑fungible tokens.

The site was hosted on Netlify, as indicated by the registrar information and the detection of Netlify and HSTS technologies. Security telemetry shows the domain appears on four blocklists—PhishDestroy, MetaMask, ScamSniffer, and SEAL—and has been flagged by three of ninety‑three security vendors on VirusTotal. The threat classification is a crypto‑related scam, consistent with the page title and the observed blocklist activity. Risk is assessed as elevated.

Defenders should immediately add tokencheckpoint.netlify.app to deny‑list rules, block outbound connections to the associated IP 98.84.224.111, and monitor for any resurgence of the domain or related Netlify subdomains. Given the presence of a valid DigiCert certificate, reliance on certificate validation alone is insufficient; contextual threat intelligence must be applied. Continuous observation of the Netlify hosting environment for new deployments that reuse the same IP range is advised, as attackers may reactivate the campaign under a different subdomain.