toknpceket[.]pro

This domain, toknpceket.pro, is identified as a high-risk credential theft operation targeting cryptocurrency wallet users. Analysis indicates the site employs phishing techniques to harvest login credentials, seed phrases, or private keys under the guise of a legitimate crypto wallet service. No specific brand impersonation or drainer kit signatures were confirmed, though the domain structure suggests an intent to mimic wallet-related services. The threat type aligns with credential theft rather than generic phishing, given the targeted nature of the attack vector. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 188.114.97.3, hosted on AS13335 (Cloudflare, Inc.) in the United States. It was registered through Dynadot LLC on February 21, 2026, though this date may reflect domain squatting or falsified registration details. The SSL certificate is issued by Google Trust Services (WE1), a common practice among malicious actors to evade basic security checks. Google Safe Browsing flags the domain as phishing, and it appears on one security blocklist. VirusTotal reports 20 out of 95 security vendors detecting the domain as malicious, with detections spanning phishing, fraud, and suspicious activity categories. The domain remains active as of this report, with no takedown actions observed. Response measures should include immediate blocking of the domain and its resolving IP at the network perimeter, alongside user education to recognize crypto-related phishing tactics. Despite Cloudflare’s hosting, the domain’s infrastructure does not exhibit additional protective measures beyond standard CDN configurations, increasing its exposure to detection and mitigation. Remaining risk is classified as high due to the domain’s confirmed malicious intent, active status, and lack of remediation. Organizations should monitor for related domains using similar naming conventions or infrastructure patterns.