tokenrewards[.]org

This domain, tokenrewards.org, is identified as a brand impersonation threat targeting OKX, a cryptocurrency exchange platform. Analysis indicates the infrastructure was designed to deceive users through a fabricated rewards or results page, as evidenced by the page title 'Official Results.' The domain does not currently exhibit overt crypto drainer functionality but operates under the pretense of official OKX communications to harvest credentials or sensitive information. Infrastructure analysis reveals the domain was registered on February 23, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with malicious domains. It resolves to the IP address 188.114.96.3, which may host additional phishing or fraudulent resources. As of the latest assessment, the domain is flagged by 5 out of 95 security vendors on VirusTotal, indicating moderate detection coverage. It appears on three security blocklists and is actively blocked by multiple threat intelligence feeds, including MetaMask and SEAL. The domain has been taken offline, reducing immediate risk to end users. However, residual threats persist due to the domain's registration remaining active until its expiration date. Users who interacted with the domain prior to its takedown may still be at risk of follow-up attacks, such as credential stuffing or targeted phishing campaigns. Organizations are advised to monitor for related infrastructure, including domains registered through the same registrar or resolving to the identified IP address. End users should verify all communications through official channels and report any suspicious activity to their security teams.