tokenclaim-dextradingclaims[.]pages[.]dev

This domain, tokenclaim-dextradingclaims.pages.dev, is flagged as an active brand impersonation threat targeting OKX, a major cryptocurrency exchange platform. Analysis indicates the site mimics legitimate OKX services under the guise of a "Multi Chain Protocol," a common tactic to deceive users into interacting with fraudulent smart contracts or disclosing sensitive credentials. No direct evidence of a crypto drainer script was observed in initial scans, though the infrastructure aligns with known impersonation campaigns designed to exploit trust in decentralized finance protocols. Infrastructure analysis reveals the following technical indicators: the domain is detected by 16 out of 95 security vendors on VirusTotal, appears on three distinct security blocklists, and was registered through Cloudflare, Inc. on June 11, 2024. It resolves to the IP address 188.114.97.3, associated with Cloudflare’s network in Canada, and presents an SSL certificate issued by Google Trust Services (WE1). The domain remains unlisted on Google Safe Browsing as of the latest verification, though it is actively blocked by PhishDestroy, ScamSniffer, and Enkrypt. Current status confirms the domain remains active, posing a high-risk threat to users unfamiliar with OKX’s official channels. Immediate response actions include reporting the domain to additional blocklist providers and notifying the registrar to assess compliance with abuse policies. Despite these measures, the domain’s persistence on Cloudflare’s infrastructure and lack of takedown action elevate the remaining risk. Users are advised to verify all OKX-related communications through official channels and avoid interacting with unsolicited claims or airdrop promotions.