claim-kuro-token[.]pages[.]dev

PhishDestroy identifies claim-kuro-token.pages.dev as an active brand impersonation domain targeting OKX, the global cryptocurrency exchange. This site poses a high-risk threat by mimicking OKX’s branding to trick users into entering private keys, passwords, or other sensitive data under the guise of a token claim process. The deceptive nature of this domain is designed to exploit user trust in legitimate platforms for financial gain or credential harvesting.

This domain was flagged with a risk level of under_investigation and is currently active. It resolves to IP address 188.114.97.3 and utilizes a Google Trust Services SSL certificate, indicating basic encryption but no guarantee of legitimacy. The site is registered through Cloudflare, Inc., a common choice for threat actors seeking to obfuscate hosting details. Notably, VirusTotal shows 0/95 detections, suggesting no immediate flags from antivirus engines as of the latest scan. The domain’s structure and use of Cloudflare Workers (pages.dev) further complicate detection and takedown efforts.

To mitigate the risk, users should avoid interacting with claim-kuro-token.pages.dev entirely. If credentials or sensitive data were entered, immediately revoke API keys, change passwords, and enable two-factor authentication on legitimate OKX accounts. Report the domain to OKX’s abuse team and consider blocking the IP 188.114.97.3 at the network level. Organizations should monitor for similar domains and educate users about verifying URLs before engaging with cryptocurrency-related claims. Proactive threat intelligence sharing can help prevent broader exploitation of this impersonation scheme.