clalm-zerobase[.]xyz

Analysis of clalm-zerobase.xyz indicates a brand‑impersonation operation targeting OKX users. The domain was registered on 17 October 2025 through NiceNIC International Group Co., Limited and resolves to 104.21.20.27, an address owned by AS13335 Cloudflare, Inc. in the United States. DNS resolution uses the Cloudflare authoritative nameservers cruz.ns.cloudflare.com and jason.ns.cloudflare.com, suggesting the attacker leveraged Cloudflare’s free tier for rapid deployment. No TLS certificate is presented; the site responded without HTTPS, which is consistent with a quickly assembled phishing landing page. The page title returned by the HTTP response is “ZEROBASE | Decentralized Trustless ZK Infrastructure for Web3 Privacy”, a content phrase that bears no obvious relation to the OKX brand, indicating the page’s primary purpose is not yet visible through the title alone.

Threat intelligence flags the domain as a wallet/seed phishing campaign. Gridinsoft assigns a trust score of 0 / 100, and eight of ninety‑five VirusTotal scanners flagged the domain as malicious, reinforcing the suspicion of illicit activity. The domain appears on a single external blocklist and has been added to PhishDestroy’s blacklist, confirming that at least one security‑operating entity has taken remediation action. The overall risk rating is elevated, and the site is currently offline, limiting immediate exposure but leaving the possibility of re‑activation. Defenders should continue to monitor the IP address 104.21.20.27 for any resurgence of phishing infrastructure, enforce blocklists that include clalm‑zerobase.xyz, and consider adding the domain to internal URL filtering policies.

Because the site lacks a valid TLS certificate, network‑level TLS inspection can be used to detect attempts to redirect victims to the domain. Threat‑intel feeds that reference the eight VirusTotal detections should be consulted for indicator correlation.