claimyourtoken[.]com

This domain, claimyourtoken.com, is flagged for brand impersonation targeting OKX, a major cryptocurrency exchange platform. The site presents itself as a promotional portal for a $DOOD token initiative by Doodles, a known NFT project, which is atypical for the targeted brand’s legitimate operations. Brand impersonation in this context typically aims to deceive users into connecting wallets or divulging credentials under the guise of exclusive token distributions, a common vector for cryptocurrency drainer kits or credential harvesting schemes. The use of a trending NFT project name in the page title suggests an attempt to exploit current market interest and user curiosity to maximize engagement with the fraudulent infrastructure. Infrastructure analysis reveals the following technical indicators: the domain resolves to the IP address 188.114.97.3, which is associated with a content delivery network known for hosting both legitimate and malicious content. It was registered on March 10, 2026, through Wild West Domains, LLC, a registrar frequently utilized for both benign and malicious domains. The SSL certificate is issued by Google Trust Services, providing an appearance of legitimacy. VirusTotal reports 0 detections out of 95 security engines, indicating the domain has not yet been flagged by major threat intelligence feeds. No entries are present in Google Safe Browsing or other prominent blocklists at the time of assessment. The creation date, set in the future (2026), is anomalous and may indicate an attempt to evade automated detection systems that rely on domain age as a risk factor. The domain remains active and under investigation, with no takedown or mitigation actions observed as of this analysis. The absence of detections on VirusTotal and blocklists does not preclude malicious intent, particularly given the domain’s impersonation of a high-value cryptocurrency brand and the use of social engineering tactics. Users are advised to exercise extreme caution and avoid interacting with the site, particularly any requests to connect wallets or input sensitive information. Organizations targeted by this impersonation should monitor for similar domains and consider preemptive blocklisting of the IP address 188.114.97.3 within their security infrastructure. Further monitoring of the domain’s behavior and network traffic is recommended to assess the full scope of the threat and identify potential affiliate infrastructure or downstream payload delivery mechanisms.