tokenairdrops[.]claims

Analysis indicates that tokenairdrops.claims is an active high‑risk brand‑impersonation site targeting users of the OKX exchange. The domain was registered on February 28, 2026 through NiceNIC International Group Co., Limited and is hosted behind Cloudflare’s network (ASN 13335) with the resolve address 104.21.40.77 located in the United States. Nameservers molly.ns.cloudflare.com and sean.ns.cloudflare.com confirm the continued use of Cloudflare’s DNS infrastructure. The site presents a TLS certificate issued by Let’s Encrypt (E8) and serves content over HTTP/3, consistent with the observed technology stack of Cloudflare Browser Insights and generic Cloudflare services.

The landing page returns HTTP 403 and displays the title “Just a moment…”, a pattern frequently associated with JavaScript challenges used to obscure malicious payloads. Independent scanning on VirusTotal reports that 2 of 95 security engines flag the domain, and the Gridinsoft trust score is 0 / 100, indicating a high likelihood of malicious intent. The domain appears on a single security blocklist and has already been blocked by PhishDestroy, reinforcing the assessment of active abuse. No additional payloads were retrieved during the snapshot, leaving the exact phishing flow uncertain.

Defenders should immediately add tokenairdrops.claims to deny‑list or firewall rules for outbound and inbound traffic, especially on endpoints that interact with OKX services. Monitoring DNS queries for the domain and its associated Cloudflare nameservers can reveal compromised hosts. Users should be warned that any unsolicited communication referencing token airdrops and directing them to this domain is likely fraudulent. Ongoing intelligence collection should focus on any evolving content behind the HTTP 403 barrier and on correlating logs for the IP address 104.21.40.77 to identify potential command‑and‑control activity.