com-token[.]xyz

Analysis of com-token.xyz, created on June 15, 2026, indicates an active high‑risk generic phishing infrastructure. The domain resolves to the single IPv4 address 45.140.205.214 and is hosted by a Cloudflare nameserver pair (celeste.ns.cloudflare.com, junade.ns.cloudflare.com). Registration was performed through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with disposable domains. The domain appears on four independent security blocklists and has been flagged by multiple client‑side extensions, including PhishDestroy, MetaMask, SEAL, and Enkrypt, suggesting that users of popular browsers and cryptocurrency wallets are being targeted. VirusTotal reports that 12 of 95 security vendors have marked the domain as malicious, reinforcing its threat profile. No public TLS certificate, HTTP status code, page title, or brand‑specific landing page information is currently available, limiting the ability to confirm the exact phishing lure. Nevertheless, the convergence of recent registration, single‑host IP, blocklist presence, and multi‑vendor detections justifies a high confidence rating. Defenders should update network and DNS filtering policies to block both the domain and its resolving IP, monitor for any future resolution changes, and consider adding the host to internal threat‑intel feeds. Continuous re‑scanning of the domain with sandbox tools is recommended to capture any evolving payloads or credential‑harvesting pages that may be deployed as the campaign matures.