trumptoken[.]lat

This domain, trumptoken.lat, is actively impersonating OKX, a cryptocurrency exchange platform, to deceive users into engaging with fraudulent token claim schemes. The site likely presents itself as an official OKX portal offering exclusive token distributions or airdrops, a common tactic to harvest login credentials, private keys, or prompt the installation of malicious software. Such impersonation campaigns are frequently used to exploit trust in established brands, targeting users unfamiliar with security best practices in the cryptocurrency space. Analysis indicates the domain was registered on March 13, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, an uncommon creation date suggesting potential domain squatting or preemptive registration for malicious use. The infrastructure resolves to the IP address 104.21.96.157 and is protected by Cloudflare, a service often leveraged to obscure hosting details and evade takedowns. The domain appears on 4 security blocklists, and 15 out of 95 security vendors on VirusTotal have flagged it as malicious. Detected technologies include Cloudflare Browser Insights and HTTP/3, further confirming the use of Cloudflare’s content delivery network. Users who have visited trumptoken.lat should immediately cease all interaction and avoid entering any credentials or personal information. If login details or private keys were submitted, affected accounts must be secured by revoking active sessions, changing passwords, and enabling multi-factor authentication where available. Devices used to access the domain should undergo a thorough security scan to detect potential malware. Additionally, users are advised to monitor financial accounts linked to cryptocurrency services for unauthorized transactions and report the domain to relevant security teams for further investigation.