claim-tokens[.]com

This domain, claim-tokens.com, is flagged as a brand impersonation threat targeting OKX, a major cryptocurrency exchange. Analysis of the infrastructure reveals a fraudulent webpage titled 'Jupiter - The Premier CEX Alternative on Solana,' designed to deceive users into believing they are interacting with a legitimate Solana-based exchange. The domain exhibits characteristics consistent with crypto-related scams, though no specific drainer kit has been conclusively identified in this instance. The page likely aimed to harvest credentials or facilitate unauthorized transactions under the guise of a trusted platform. Infrastructure analysis reveals the following technical indicators: the domain was created on February 21, 2026, and resolves to the IP address 23.145.80.20, hosted by AS397666 (HostRound LLC) in the United States. The SSL certificate is issued by ZeroSSL RSA Domain Secure Site CA. VirusTotal reports 12 out of 95 security vendors flagging the domain as malicious. The domain appears on one security blocklist and was previously blocked by PhishDestroy. No Google Safe Browsing (GSB) detection is noted in the available data, though this may reflect the domain's recent takedown rather than a clean status. As of the latest assessment, claim-tokens.com has been taken offline, reducing immediate exposure to potential victims. However, the elevated risk classification persists due to the domain's recent creation date, which may indicate an attempt to evade detection or suggest the possibility of reactivation. Users who interacted with the domain prior to its takedown should revoke any connected wallet permissions, monitor accounts for unauthorized activity, and reset credentials associated with cryptocurrency platforms. Organizations should maintain vigilance for similar impersonation domains leveraging misspelled or hyphenated variations of legitimate exchange names.