dappstokenchainportal[.]com

The domain dappstokenchainportal.com is actively hosting a site that claims the title “SyncFi” and is explicitly listed as an impersonation of the cryptocurrency exchange brand OKX. The site presents a valid HTTPS certificate issued by Let’s Encrypt (R13) and returns HTTP 200 for requests, indicating a fully operational web service. Analysis of public threat feeds shows the domain is present on four security blocklists and is flagged by three of ninety‑five VirusTotal scanners, confirming malicious intent.

The domain was registered on 11 August 2025 through the registrar Ultahost, Inc., and all authoritative name servers (ns1‑ns4.ultahost.com) resolve to the single IPv4 address 192.142.10.5. Geo‑IP data places this address in the Netherlands and associates it with ASN 214036, which is owned by Ultahost, Inc. Scamadviser assigns a trust score of 1 out of 100, and the site is categorized as a cryptocurrency‑related scam. The domain’s current status remains active.

Public intelligence indicates that the site is already blocked by multiple anti‑phishing aggregators, including PhishDestroy, Polkadot, Enkrypt, and Codeesura. However, the specific page content, form fields, or credential‑harvesting mechanisms have not been publicly disclosed, leaving a gap in the tactical understanding of the campaign’s payload. The low trust score and the brand‑impersonation label suggest a high probability of credential theft or funds diversion targeting OKX users.

Defenders should update perimeter controls to deny any outbound or inbound traffic to dappstokenchainportal.com and to the resolving IP 192.142.10.5. Security information and event management (SIEM) rules ought to be tuned to generate alerts on DNS queries or HTTP requests to this domain. Threat‑intel feeds should be refreshed to include the listed blocklist identifiers, and user‑facing communications should warn personnel about a fake “SyncFi” portal that pretends to be associated with OKX.