token[.]publicai[.]name

The domain token.publicai.name is currently active and is listed as a brand‑impersonation campaign targeting the cryptocurrency exchange OKX. The site returns an HTTP 403 response and its page title is reported as “Just a moment…”, indicating that the landing page is likely serving a challenge or placeholder rather than a conventional login form. The threat is classified as high risk, and the campaign remains operational according to the latest intelligence. Infrastructure analysis shows the domain is hosted behind Cloudflare, using the nameservers iris.ns.cloudflare.com and wilson.ns.cloudflare.com. DNS resolution points to the IPv6 address 2606:4700:3032::6815:5cea, which belongs to AS13335 Cloudflare, Inc., located in the United States. The TLS certificate is issued by Google Trust Services under the WE1 certificate profile, confirming the use of a valid public‑key infrastructure. Automated scanning on VirusTotal recorded 2 detections out of 95 security vendors, and the domain appears on one external blocklist. The site employs Cloudflare Browser Insights and HTTP/3, consistent with typical Cloudflare‑protected services. Defenders should treat token.publicai.name as a malicious indicator. Immediate actions include adding the domain and its associated IPv6 address to network deny lists, updating email and web filtering rules, and ensuring that any endpoint detection components flag connections to the IP as suspicious. Because the content behind the 403 response has not been publicly disclosed, further investigation using a sandboxed browser session is advisable to capture any credential‑harvesting payloads or redirection behavior. Continuous monitoring of the domain’s DNS records and the Cloudflare‑associated IP range is recommended, as the attacker may shift infrastructure while retaining the same brand‑impersonation theme.