tokenclaimsprotocol[.]live

The domain tokenclaimsprotocol.live is currently active and has been flagged for high-risk brand impersonation targeting the cryptocurrency exchange platform OKX. Created on May 25, 2026, this domain has a Gridinsoft trust score of 0/100, indicating a complete lack of trustworthiness. The domain’s SSL certificate, issued by Let's Encrypt, further complicates detection as it provides a false sense of security. Analysis indicates that the domain appears on three security blocklists, suggesting that it has been identified by multiple threat intelligence sources as malicious. The HTTP status code 200 confirms that the domain is accessible and operational, which is concerning given its high-risk status. The nameservers are managed by Cloudflare, specifically dell.ns.cloudflare.com and zahir.ns.cloudflare.com, and the domain resolves to the IP address 172.67.137.80, located in Canada. This combination of infrastructure choices is often seen in phishing campaigns that seek to leverage reputable services to evade detection. While the domain is flagged by only 2 out of 95 security vendors on VirusTotal, this low detection rate does not mitigate the risk, as brand impersonation campaigns can be highly targeted and may evade broad detection. Defenders should be vigilant and implement additional layers of security, such as DNS-based blocking, to prevent users from accessing this domain. It is also recommended to monitor for any related subdomains or IP addresses that may be part of the same campaign. Current evidence suggests that the domain is still being used to impersonate OKX, and users should be advised to verify the authenticity of any communications or links related to OKX through official channels.