autoclaimtokentoken[.]pages[.]dev

PhishDestroy identifies the active domain autoclaimtokentoken.pages.dev as a fraudulent website engaging in brand impersonation targeting OKX users.

This domain has been flagged by 3 of 95 VirusTotal vendors as of the most recent scan, indicating it has not yet been widely recognized as malicious. The domain was registered through Cloudflare, Inc., resolves to IP address 172.66.47.4, and holds a Let's Encrypt SSL certificate. Current infrastructure analysis shows no record of this domain appearing on major threat intelligence blocklists, and trust scores remain unverified due to its recent emergence.

This domain remains active and poses a significant risk to users seeking to interact with legitimate OKX services. Security teams are advised to immediately block traffic to autoclaimtokentoken.pages.dev at the network perimeter and monitor endpoints for any user engagement with this fraudulent site. Additionally, organizations should update user awareness training to specifically highlight the risks of OKX impersonation campaigns and ensure employees verify domain authenticity through official OKX channels before entering credentials or financial information.