gastoken-refund[.]web[.]app

Gastoken-refund.web.app poses a significant threat by impersonating the cryptocurrency platform OKX. This domain is flagged by 2 out of 91 vendors on VirusTotal and appears on public blocklists maintained by PhishDestroy and ScamSniffer. The site uses the title 'Ethereum ETH 2.0' to lure victims, suggesting a connection to Ethereum's blockchain upgrade.

Registered through Google LLC and hosted by Fastly, Inc. in the US, the domain benefits from a Google Trust Services SSL certificate. This might lend it an air of legitimacy, potentially deceiving users into believing it is a genuine service related to Ethereum or OKX. The platform risk score is 76/100, indicating a high likelihood of malicious activity.

PhishDestroy first flagged this domain on May 28, 2026. Despite its recent detection, the site has already been identified as malicious by two security vendors. The domain's use of a reputable registrar and hosting service underscores the sophisticated tactics employed by threat actors to bypass initial security checks. The presence of this domain on blocklists highlights the ongoing efforts to curb its impact, but users should remain cautious when encountering similar sites.