token2049[.]sale

The domain token2049.sale was observed pointing to the IPv6 address 2606:4700:3035::ac43:958e, which is owned by Cloudflare, Inc. (AS13335) and resolves to a US‑based edge location. DNS records list the authoritative name servers maisie.ns.cloudflare.com and zahir.ns.cloudflare.com, confirming that the domain’s registration and DNS services are also provisioned through Cloudflare. The site presented the page title “Token2049 — Play, Own, Earn | DeFi Gaming at TOKEN2049,” suggesting an attempt to mimic the legitimate Token2049 brand, which aligns with the classified threat of brand impersonation. SSL termination is handled by a Google Trust Services certificate (WE1), indicating a valid TLS chain but offering no assurance about the underlying content.

Traffic was served over HTTP/3, a protocol supported by Cloudflare’s modern edge network. VirusTotal analysis recorded detections by six of ninety‑five scanning engines, and the domain appears on a single security blocklist. PhishDestroy has taken the domain offline, and it is currently listed as a crypto‑related scam.

The evidence points to a coordinated effort to lure victims by leveraging the Token2049 brand for a DeFi gaming narrative, yet the site is no longer reachable for direct inspection. Defenders should continue to block the domain at network perimeter devices, monitor Cloudflare‑associated IP ranges for similar impersonation attempts, and update phishing‑filtering lists with the domain hash. Analysts should also query threat‑intel feeds for any emerging indicators tied to the same IP block or certificate fingerprint, as the underlying infrastructure could be reused for future campaigns.