fleektoken[.]top

Analysis of the domain fleektoken.top indicates it was actively involved in a cryptocurrency presale scam impersonating Binance, as evidenced by its page title 'Fleek Presale - 124,000 FLEEK per 1 BNB' and explicit classification as a crypto scam. The domain was registered on October 4, 2025, through NameSilo, LLC, and resolves to the IP address 45.12.2.67, hosted on AS6698 (Virtual Systems LLC) in Ukraine. Infrastructure analysis reveals the use of custom nameservers (ns1.fleektoken.top, ns2.fleektoken.top, ns1.juniperbot.top, ns2.juniperbot.top), which may suggest an attempt to maintain control over DNS resolution or facilitate rapid redeployment of malicious infrastructure. At the time of assessment, the domain lacks an SSL certificate, increasing the likelihood of interception or tampering with user communications. Detection metrics from security vendors are limited but notable: two of 95 vendors on VirusTotal flagged the domain as malicious, while PhishDestroy has explicitly blocked it.

The domain appears on one additional security blocklist, and Gridinsoft assigns it a trust score of 0/100, further corroborating its malicious classification. As of July 24, 2026, the domain is offline, though the underlying infrastructure (IP, nameservers) may remain active and capable of supporting future campaigns. The absence of widespread detection does not indicate safety; rather, it may reflect the domain's recent takedown or limited exposure. Defenders should treat this domain as part of a broader pattern of cryptocurrency scams targeting Binance users. The use of a high-value presale offer (124,000 FLEEK per 1 BNB) aligns with common social engineering tactics designed to exploit urgency and perceived financial opportunity.

While the exact content and mechanics of the scam are not fully analysed, the available evidence—including the page title, scam type, and brand impersonation—supports its classification as a fraudulent scheme. Network-level blocking of the IP 45.