5th-scape-token[.]pages[.]dev

The domain 5th-scape-token.pages.dev is currently under investigation for brand impersonation. It poses a specific risk by mimicking the well-known cryptocurrency exchange, OKX, potentially leading to financial and personal data loss.

Infrastructure analysis reveals that the domain was created on February 02, 2025, and is registered through Cloudflare, Inc. It resolves to the IP address 172.66.44.253, which is located in the United States and associated with AS13335 Cloudflare, Inc. The SSL certificate is issued by Google Trust Services / WE1, adding a layer of legitimacy that could be leveraged to deceive users. Despite these findings, the domain has not been flagged by VirusTotal, with 0/95 detections. The domain appears on one security blocklist, specifically PhishDestroy, which indicates a level of suspicion among security professionals. The current page title, '5thScape - Best Crypto Presale | Crypto ICO 2025 Now LIVE!', further supports the impersonation of OKX by attempting to lure users with a misleading crypto presale offer.

To mitigate the risk posed by this brand impersonation, it is recommended to enhance domain monitoring and blocklisting efforts. Users should be educated to carefully verify URLs and SSL certificates before engaging with any cryptocurrency-related websites. Additionally, security teams should actively monitor for any DNS or network anomalies associated with this domain and consider implementing more stringent access controls and authentication mechanisms to prevent unauthorized access and data exfiltration. Collaboration with Cloudflare and relevant security blocklists can help in taking down the domain and preventing further harm.