cupseytokens[.]xyz

Analysis of cupseytokens.xyz indicates a newly registered domain (creation date July 15, 2026) that is currently active and points to the IP address 172.67.181.194. The domain is delegated to Cloudflare nameservers (ignat.ns.cloudflare.com, liberty.ns.cloudflare.com) and was registered through Dynadot Inc. A VirusTotal scan involving 91 security vendors returned no current flags, but the absence of detections does not constitute proof of safety. The indicator set classifies the activity as a delivery_scam and places the domain under investigation with an active status. Infrastructure observations suggest the domain is using a shared Cloudflare edge IP, a common tactic for rapidly deployed scam sites that benefit from anonymizing the true hosting location. No content or payload analysis is available, leaving the exact malicious behavior unconfirmed beyond the delivery scam attribution. Defenders should treat the domain as potentially malicious: block outbound connections to the resolved IP, add the domain to DNS filtering or sinkhole lists, and monitor network traffic for any recent or future attempts to resolve or contact cupseytokens.xyz. Continuous re‑assessment is recommended as additional intelligence (e.g., sandbox analysis or phishing page snapshots) becomes available.