claimtokensfinance[.]pages[.]dev

This domain, claimtokensfinance.pages.dev, is flagged as a high-risk brand impersonation threat targeting OKX, a cryptocurrency exchange platform. The site presents itself as an airdrop claim portal, using the page title 'Claim AIRDROP' to lure victims into interacting with malicious infrastructure. Analysis indicates the domain is designed to harvest credentials or deploy wallet-draining scripts, a common tactic in cryptocurrency phishing campaigns. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on December 18, 2024, and resolves to the IP address 172.66.47.103, located in Canada. Security vendor detections on VirusTotal report 11/95 flags for phishing-related activity. Google Safe Browsing has classified the domain as phishing, and it appears on at least one security blocklist. The use of Cloudflare hosting is notable, as it obscures the true origin of the malicious content while providing SSL encryption to appear legitimate. As of the latest verification, claimtokensfinance.pages.dev remains active and operational. While it has been blocked by some security filters, the domain continues to pose a significant risk to users unaware of the impersonation scheme. Organizations and individuals are advised to update blocklists with the domain and IP address, monitor for related indicators of compromise, and educate users on recognizing fraudulent airdrop claims. The remaining risk is elevated due to the domain's persistence and the targeted nature of the campaign.