dappchaintoken[.]pages[.]dev

This domain, dappchaintoken.pages.dev, is identified as a brand impersonation scam specifically targeting users of the OKX cryptocurrency exchange platform. Analysis indicates the site masquerades as a legitimate authentication protocol under the guise of 'SwiftAuthProtocol' or 'Swift Network,' a tactic commonly employed to deceive users into disclosing sensitive credentials or authorizing fraudulent transactions. The domain is currently offline, though prior activity suggests it was operational for malicious purposes. Infrastructure analysis reveals the domain was registered on April 22, 2026, through Cloudflare, Inc., and resolves to the IP address 172.66.47.78. Despite its malicious intent, the domain has not been flagged by any of the 95 vendors on VirusTotal, indicating either recent deployment or evasion techniques. However, it appears on three security blocklists and is actively blocked by MetaMask, PhishDestroy, and SEAL. The SSL certificate is issued by Google Trust Services, a common practice among threat actors to lend an air of legitimacy to fraudulent sites. Gridinsoft assigns the domain a trust score of 0 out of 100, further corroborating its malicious classification. Given the domain's current offline status, immediate threat mitigation is reduced; however, historical activity and infrastructure indicators warrant continued vigilance. Organizations and users are advised to block the domain and associated IP address at the network level. Security teams should monitor for similar domains registered through Cloudflare or utilizing Google Trust Services certificates, particularly those impersonating cryptocurrency platforms. End-users should verify the authenticity of any authentication or transaction prompts by cross-referencing official communication channels and avoiding interaction with unsolicited links or domains.