playnancetoken[.]live

The domain playnancetoken.live has been identified as a brand impersonation threat specifically targeting OKX, a cryptocurrency exchange platform. Analysis confirms this domain was designed to deceive users through a fraudulent claim portal, categorized under credential harvesting and brand abuse. The domain is currently offline, though prior activity indicates a high-risk profile for users who may have interacted with it before takedown. Infrastructure analysis reveals the domain was registered on June 14, 2024, through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolved to the IP address 216.198.79.65 and was flagged by 4 of 95 security vendors on VirusTotal, indicating moderate detection coverage. The domain appeared on one security blocklist and was actively blocked by PhishDestroy. The SSL certificate was issued by Let's Encrypt, a common tactic to lend superficial legitimacy to phishing sites. The page title, 'Playnance — Claim Portal,' directly mimics legitimate promotional or airdrop campaigns associated with cryptocurrency platforms. Current status confirms the domain has been taken offline, reducing immediate exposure. However, the infrastructure remains a concern due to the recent registration date and the use of a known registrar frequently associated with malicious domains. Organizations and users are advised to block the domain and IP address at the network level, revoke any credentials entered on the site, and monitor for secondary phishing attempts. Security teams should review logs for connections to 216.198.79.65 and the domain playnancetoken.live, particularly from endpoints involved in cryptocurrency transactions. Proactive threat hunting is recommended to identify compromised accounts or lateral movement linked to this campaign.