goodegg-token[.]pages[.]dev

The domain goodegg-token.pages.dev is currently engaged in brand impersonation targeting OKX, a major cryptocurrency exchange platform. This domain operates as a high-risk phishing site, presenting itself as a legitimate token presale portal under the guise of "GoodEgg | $GEGG Presale Live Now." Analysis confirms its active status, with infrastructure designed to deceive users into disclosing sensitive credentials or transferring digital assets under false pretenses. Infrastructure analysis reveals the domain was registered on June 09, 2026, through Cloudflare Pages, a platform frequently leveraged for rapid deployment of fraudulent sites. It resolves to the IP address 188.114.96.3, a Cloudflare-hosted endpoint commonly associated with malicious activity. Detection metrics indicate the domain is flagged by 10 of 95 security vendors on VirusTotal, while appearing on three distinct security blocklists. The SSL certificate, issued by Google Trust Services (WE1), provides a superficial layer of legitimacy but does not mitigate the underlying threat. Additional intelligence confirms the domain is actively blocked by multiple threat intelligence feeds, including PhishDestroy, MetaMask, and SEAL. Current assessment classifies this domain as an active, high-severity threat. Organizations and end-users are advised to implement immediate network-level blocking for 188.114.96.3 and the domain goodegg-token.pages.dev. Cryptocurrency platforms should issue warnings to users regarding fraudulent presale schemes, particularly those impersonating established exchanges. Security teams are recommended to monitor for related domains registered through Cloudflare Pages, as this infrastructure is frequently repurposed for phishing campaigns. Users encountering this domain should avoid interaction, refrain from entering credentials, and report the site to relevant abuse channels for takedown.