claim-solaxytoken-io[.]pages[.]dev

This domain operates as a high-risk brand impersonation scam targeting users of the OKX cryptocurrency exchange. The site presents itself as a legitimate token presale platform named 'Solaxy,' using the page title 'Solaxy: Discover SOLX Token and the Solaxy Crypto Presale' to lure victims into entering sensitive account information or transferring funds. Analysis indicates the site is designed to harvest login credentials, private keys, or wallet recovery phrases under false pretenses, likely leading to unauthorized access and financial theft from OKX user accounts. Infrastructure analysis reveals multiple technical indicators confirming malicious intent. The domain was registered through Cloudflare Pages on June 9, 2026, and currently resolves to the IP address 172.66.44.99. It uses an SSL certificate issued by Google Trust Services (WE1), which provides a false sense of security to visitors. Security vendor detection on VirusTotal shows 5 out of 95 engines flagging the domain as malicious, while it appears on at least one security blocklist. The domain remains active as of this report, continuing to pose an immediate threat to unsuspecting users. Users who have visited claim-solaxytoken-io.pages.dev or interacted with its content should take immediate action to secure their accounts. First, revoke any connected wallet permissions or API keys associated with the site. Change passwords for OKX and any other financial accounts where the same credentials may have been reused. Enable multi-factor authentication if not already active. Monitor account activity for unauthorized transactions and report any suspicious behavior to the legitimate platform. If cryptocurrency was transferred to addresses provided by the site, document all transaction hashes and contact law enforcement or relevant financial authorities. Do not attempt to interact further with the domain or its operators.