jwwtoken1[.]pages[.]dev

PhishDestroy identifies jwwtoken1.pages.dev as an active brand impersonation domain currently under investigation for cryptocurrency draining activities. This domain specifically masquerades as the legitimate exchange OKX, leveraging deceptive branding to trick users into connecting cryptocurrency wallets or entering sensitive credentials. The threat remains active, with no confirmed takedown at the time of this assessment. Users are advised to exercise extreme caution when encountering this domain or any associated links.

This domain was flagged by 0 of 95 VirusTotal vendors, indicating it has not yet been widely recognized as malicious by automated security systems. It is registered through Cloudflare, Inc., resolving to IP address 188.114.96.3 with a Google Trust Services SSL certificate. While the exact registration date is not provided, the domain's creation and deployment are recent, as evidenced by its active status. The absence of VirusTotal detections, combined with Cloudflare's hosting, suggests this threat is still in its early stages of operation. Trust scores for this domain remain unverified due to its low detection rate.

The current status of jwwtoken1.pages.dev is classified as active, with a risk level marked as under investigation. PhishDestroy recommends users avoid interacting with this domain entirely. If you suspect exposure to this site, disconnect any connected cryptocurrency wallets immediately and scan your device for malware. For verification, users can cross-check the domain against PhishDestroy's latest threat intelligence database. Always verify URLs, certificates, and branding before entering sensitive information or authorizing transactions.