tokenairdropclaim[.]pages[.]dev

This domain, tokenairdropclaim.pages.dev, is currently flagged as an active brand impersonation threat targeting OKX, a major cryptocurrency exchange platform. The site operates as a crypto drainer, designed to deceive users into connecting wallets under the pretense of a token airdrop or support resolution, ultimately facilitating unauthorized fund transfers. As of the latest analysis, the domain remains operational and unmitigated, posing a high risk to unsuspecting visitors seeking legitimate OKX services or promotions.

Infrastructure analysis reveals the domain was registered on March 07, 2025, through Cloudflare, Inc., a registrar frequently leveraged by threat actors for its privacy and proxy services. The domain resolves to the IP address 172.66.47.155, geolocated in Canada and associated with Cloudflare’s content delivery network. Detection metrics indicate the domain has been flagged by 13 of 95 security vendors on VirusTotal, while only appearing on a single blocklist, PhishDestroy. The page title, "Decentralized Dapps - We are help to help you resolve your crypto related issues," further corroborates the impersonation tactic, mimicking legitimate support or promotional content to lower user vigilance.

Current status confirms the domain remains active, with no evidence of takedown or mitigation efforts. Users are strongly advised to avoid interaction with tokenairdropclaim.pages.dev and any associated links. Organizations should update blocklists to include this domain and its resolving IP, while end-users should verify all promotional or support communications directly through official OKX channels. Wallet providers and browser security extensions are recommended to flag this domain as malicious to prevent further exploitation.