webdisk[.]blockchainstoken[.]world

Analysis of webdisk.blockchainstoken.world indicates a high‑risk brand‑impersonation campaign targeting OKX users. The domain was registered on 21 February 2026 through OwnRegistrar, Inc. and is currently resolved to Cloudflare name servers matteo.ns.cloudflare.com and laylah.ns.cloudflare.com, confirming the use of Cloudflare’s CDN and HTTP/3 support. An HTTP request returns a 403 status and the page title is recorded as “Just a moment…”, a common placeholder that suggests the site is not serving the expected login interface but is intentionally obscuring content. Gridinsoft assigns a trust score of 0/100, and one of ninety‑three VirusTotal scanners has flagged the domain, reinforcing the malicious assessment. The domain appears on a single security blocklist and is listed as blocked by PhishDestroy, indicating that at least one anti‑phishing feed already recognizes the threat. The only confirmed malicious indicator is the explicit impersonation of the OKX brand, which aligns with the reported cryptocurrency scam type. Uncertainties remain regarding the exact payload or credential‑harvesting mechanisms, as no additional page content or network traffic has been captured. Defenders should add the domain to block lists, monitor DNS queries for the associated Cloudflare name servers, and enforce email or web gateway rules that detect references to OKX in conjunction with this domain. Continuous observation is advised to capture any evolving behavior or additional infrastructure components.