rewards-token[.]works

This domain is flagged as a high-risk brand impersonation threat specifically targeting OKX, a prominent cryptocurrency exchange platform. The site employs deceptive branding elements, including the page title 'TokenWorks™,' to mislead users into believing they are interacting with an official OKX service. Brand impersonation of this nature typically aims to harvest credentials, distribute malware, or facilitate cryptocurrency theft through social engineering tactics. Analysis indicates the domain rewards-token.works was registered on May 28, 2024, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with malicious domains. The domain resolves to the IP address 172.67.173.119, hosted on AS13335 (Cloudflare, Inc.), a network commonly used to obfuscate the true origin of phishing infrastructure. As of the latest assessment, the domain appears on four security blocklists, including PhishDestroy, MetaMask, ScamSniffer, and SEAL. VirusTotal detection rates show 2 out of 95 security vendors flagging the domain as malicious. The SSL certificate is issued by Let's Encrypt, a legitimate certificate authority, which does not mitigate the inherent risk posed by the domain's fraudulent intent. To mitigate risks associated with this brand impersonation threat, users are advised to verify the authenticity of any communication or website claiming affiliation with OKX by cross-referencing official channels. Cryptocurrency wallet interactions should be restricted to verified domains, and users should avoid entering sensitive information on untrusted platforms. Network-level protections, such as DNS filtering or endpoint detection rules, should be configured to block access to known malicious domains, including rewards-token.works. Organizations should monitor for indicators of compromise, such as unexpected redirects or unauthorized transaction attempts, and report suspicious activity to relevant security teams for further investigation.