ton-claim[.]tokentable[.]xyz

The domain ton-claim.tokentable.xyz is identified as a brand impersonation threat specifically targeting OKX, a prominent cryptocurrency exchange platform. Analysis confirms this domain was actively used to deceive users by mimicking legitimate OKX services under the guise of a token distribution or claim portal, as indicated by the page title 'TokenTable.' The domain is currently offline, though its prior activity warrants continued monitoring. Infrastructure analysis reveals the domain was registered through Amazon Registrar, Inc. on April 06, 2023, and resolved to the IP address 18.66.147.108. Detection metrics indicate minimal but notable coverage, with 1 of 95 security vendors on VirusTotal flagging the domain as malicious. Additionally, the domain appears on one security blocklist, further corroborating its suspicious nature. The SSL certificate is issued by Amazon, specifically under the Amazon RSA 2048 M02 profile, which is consistent with infrastructure commonly used for both legitimate and malicious purposes. At present, ton-claim.tokentable.xyz is offline, though users should remain vigilant against similar threats. Organizations and individuals are advised to block the domain and its associated IP address at the network level. Users who may have interacted with this domain should verify account integrity, revoke any suspicious permissions, and monitor for unauthorized transactions. Security teams are encouraged to correlate this domain with other indicators of compromise, particularly those involving cryptocurrency-related phishing campaigns.