tokenbridger[.]pages[.]dev

This domain, tokenbridger.pages.dev, is flagged as a high-risk brand impersonation site targeting OKX, a major cryptocurrency exchange. Analysis indicates the site masquerades as a crypto bridge service, using the page title 'The Best Crypto & Binance Bridge | cBridge' to deceive users into interacting with malicious infrastructure. No direct evidence of a crypto drainer kit has been observed, but the domain's intent aligns with credential theft or wallet compromise tactics common in cryptocurrency fraud schemes. Infrastructure analysis reveals the domain is hosted on Cloudflare (AS13335) and resolves to IP 172.66.46.246, located in the US. The domain is registered through Cloudflare, Inc., and currently holds a VirusTotal detection score of 0/95, indicating no antivirus engines have flagged it as malicious. However, it appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL. The SSL certificate is issued by Google Trust Services (WE1), a common attribute in both legitimate and malicious Cloudflare-hosted domains. No Google Safe Browsing (GSB) flags are present at this time. As of the latest assessment, tokenbridger.pages.dev remains active and continues to resolve. The domain's low detection rate on antivirus platforms contrasts with its presence on specialized blocklists, suggesting targeted or emerging threats. Users are advised to treat this domain as malicious and avoid interaction. Organizations should update blocklists to include this domain and monitor for related infrastructure. The remaining risk is classified as high due to the active status and brand impersonation tactics employed.