royal-token-presale[.]pages[.]dev

The domain royal-token-presale.pages.dev is currently under investigation for brand impersonation targeting OKX, a major cryptocurrency exchange. Analysis indicates this infrastructure is designed to mimic legitimate token presale events, potentially facilitating fraudulent transactions or credential harvesting. The page displays the title 'Royal Token - Powering the Future of Trading,' reinforcing the false association with OKX's branding and services. Infrastructure analysis reveals the domain resolves to IP address 172.66.47.11 and was registered through Cloudflare Pages on June 09, 2026. Despite its recent creation, it has already been flagged by one security blocklist (PhishDestroy) but remains undetected by all 95 VirusTotal vendors as of the latest scan. The SSL certificate is issued by Google Trust Services (WE1), which may lend an appearance of legitimacy to unsuspecting users. The domain's hosting provider and registration details align with patterns observed in other brand impersonation campaigns targeting cryptocurrency platforms. Current status indicates the domain remains active and unblocked by most security vendors. Users are advised to exercise extreme caution when encountering this domain, particularly if prompted to connect wallets or enter credentials. Organizations should consider proactively blocking the domain and IP address in network security controls. Verification of any token presale or promotional offers should be conducted exclusively through official OKX channels to mitigate the risk of financial loss or data compromise.