token-powergacha[.]com

This domain, token-powergacha.com, is flagged as a high-risk brand impersonation threat targeting OKX, a major cryptocurrency exchange. Analysis indicates the domain was designed to deceive users into participating in a fraudulent $GACHA token airdrop, a common tactic to lure victims into crypto drainer schemes or credential theft. The page title, $GACHA Token Airdrop, directly references a non-existent token, exploiting user interest in promotional events to facilitate malicious activity. Infrastructure analysis reveals the domain was registered on May 30, 2026, through MAT BAO CORPORATION, a registrar with a history of hosting suspicious domains. It resolves to the IP address 172.67.213.33, which is associated with Cloudflare infrastructure, a common obfuscation technique to mask the true origin of malicious sites. The domain is detected by 11 out of 95 security vendors on VirusTotal, and it appears on three security blocklists. Technologies detected include HSTS, Cloudflare Browser Insights, and HTTP/3, which may be leveraged to enhance the site's perceived legitimacy or evade detection. As of the latest assessment, token-powergacha.com has been taken offline, likely due to enforcement actions by security providers or hosting services. The domain was blocked by multiple security tools, including browser-based protections and threat intelligence feeds. Despite its current offline status, the risk of re-emergence remains, as threat actors frequently repurpose or re-register similar domains. Users are advised to verify the authenticity of any airdrop or promotional event directly through official channels and to monitor for domains mimicking legitimate brands. Organizations should update blocklists to include this domain and its associated indicators to prevent future exposure.