doodtokens[.]xyz

This domain, doodtokens.xyz, is identified as a high-risk brand impersonation threat targeting users of the cryptocurrency exchange OKX. Analysis indicates the domain was specifically designed to mimic legitimate airdrop campaigns, leveraging social engineering tactics to deceive victims into disclosing sensitive credentials or transferring assets. The domain is currently offline, but its infrastructure and historical activity warrant continued scrutiny. Infrastructure analysis reveals the domain was flagged by 13 of 95 security vendors on VirusTotal, indicating widespread detection as malicious. It was registered through Web Commerce Communications Ltd on August 11, 2025, and resolves to the IP address 188.114.97.3. The domain appears on four security blocklists and is assigned a trust score of 0/100 by Gridinsoft. Technologies detected include Node.js, Vue.js, Nuxt.js, and Cloudflare, suggesting a modern, obfuscated frontend designed to evade basic detection mechanisms. The page title, 'Doodles | Airdrop,' further supports the conclusion that this domain was engineered to exploit users expecting legitimate token distributions. Current status confirms the domain is offline, though this does not eliminate the risk of resurgence or similar campaigns. Organizations and individuals are advised to block the domain and its associated IP at the network level, update endpoint protection rules to include the observed indicators, and monitor for related infrastructure. Users should be educated on the risks of airdrop scams, particularly those impersonating major exchanges, and instructed to verify all communications through official channels. Historical data suggests such domains often reappear under slight variations, necessitating proactive threat hunting for similar patterns.