tokabu[.]net

This domain, tokabu.net, poses a credential theft threat targeting cryptocurrency users by impersonating a legitimate token airdrop. Visitors are presented with a page titled 'Welcome to $TOKABU,' designed to harvest wallet credentials or personal information under the guise of a promotional giveaway. The site employs social engineering tactics to trick users into disclosing sensitive data, which can then be exploited for unauthorized access to digital assets or financial accounts. Analysis indicates the domain was registered on August 16, 2025, through Web Commerce Communications Limited, a registrar frequently associated with high-risk domains. Infrastructure analysis reveals the site resolves to the IP address 188.114.96.3 and is currently flagged by 1 out of 95 security vendors on VirusTotal. Additionally, the domain appears on two security blocklists and has been assigned a trust score of 0/100, further confirming its malicious nature. The combination of recent registration, low detection rates, and association with known phishing infrastructure underscores the elevated risk posed by this site. Individuals who visited tokabu.net should immediately revoke any permissions granted to connected cryptocurrency wallets and monitor their accounts for unauthorized transactions. If credentials or wallet details were entered, affected users should transfer assets to a new, secure wallet and enable multi-factor authentication on all related accounts. It is also recommended to scan local devices for malware, as phishing sites may deploy additional payloads. Users should report the domain to their wallet provider or relevant security platforms to aid in broader mitigation efforts.