bdagtokenclaim[.]live

The domain www.bdagtokenclaim.live is currently active and classified as a brand impersonation threat specifically targeting OKX, a well-known cryptocurrency exchange platform. This domain presents itself as a token claim portal under the name BlockDAG, a tactic commonly employed to deceive users into disclosing sensitive credentials or transferring digital assets under false pretenses. The page title, BlockDAG | Claim, further reinforces the appearance of legitimacy while masking its fraudulent intent. Infrastructure analysis reveals multiple concrete indicators of malicious activity. The domain is flagged by 5 of 95 security vendors on VirusTotal, including detection by PhishDestroy. It is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. The domain resolves to the IP address 64.29.17.65, which has been observed in prior fraudulent campaigns. Additionally, the domain appears on one security blocklist, and its SSL certificate is issued by Let’s Encrypt, a common choice among threat actors due to its low barrier to entry and lack of stringent validation. The combination of these factors—low vendor detection but specific blocklist inclusion—suggests targeted or emerging malicious activity rather than widespread recognition. As of this assessment, www.bdagtokenclaim.live remains active and poses an elevated risk to users, particularly those affiliated with OKX or cryptocurrency transactions. Organizations and individuals are strongly advised to block access to this domain at the network level and update endpoint protection rules to include its IP and associated indicators. Users should be educated to recognize brand impersonation tactics, especially those involving unsolicited token claims or airdrops. Verification of any cryptocurrency-related offers should be conducted exclusively through official channels, and suspicious domains should be reported to relevant threat intelligence platforms for broader mitigation.