reward-hodltoken[.]pages[.]dev

The domain reward-hodltoken.pages.dev is currently active and engaged in brand impersonation, specifically targeting users of the cryptocurrency exchange OKX. This infrastructure is designed to deceive victims by presenting itself as an official OKX platform, likely to facilitate fraudulent transactions or credential harvesting. Analysis indicates this is not a generic phishing attempt but a targeted impersonation scheme aimed at exploiting trust in the OKX brand. Infrastructure analysis reveals the domain was registered through Cloudflare Pages and created on May 11, 2026. As of the latest assessment, it has been flagged by 0 of 95 vendors on VirusTotal, indicating it has not yet been widely detected by security engines. However, it appears on three security blocklists and is actively blocked by at least three independent security providers, including domain reputation and wallet protection systems. The absence of detections on VirusTotal does not correlate with safety, as brand impersonation domains often evade initial scans through obfuscation or delayed malicious payload delivery. Current status confirms the domain remains operational and poses a high risk to users. The infrastructure exhibits characteristics typical of crypto drainer or credential theft operations, including the use of a Cloudflare-hosted subdomain to mask origin and evade traditional detection. Users are advised to avoid interaction with this domain entirely. Organizations should update blocklists to include reward-hodltoken.pages.dev, monitor for related subdomains, and educate users on verifying official communication channels. Security teams should treat any traffic to this domain as malicious and investigate associated endpoints for compromise.