emaartoken[.]xyz

This domain, emaartoken.xyz, is identified as a brand impersonation threat specifically targeting OKX, a cryptocurrency exchange platform. The site presents itself as an airdrop campaign titled 'Emaar Launching Coin (EMAAR) — Residents Airdrop,' falsely associating with the legitimate Emaar brand to deceive users into divulging sensitive credentials or transferring assets. The domain is currently offline, but prior activity indicates a deliberate attempt to exploit trust in established brands for financial fraud. Analysis of technical indicators reveals the domain was registered through NiceNIC International Group Co., Limited on February 21, 2026, an unusually future-dated creation that may suggest registry manipulation or data obfuscation. It resolves to IP address 172.67.166.128, hosted on AS13335 Cloudflare, Inc., a common infrastructure choice for threat actors due to its anonymization capabilities. The domain appears on one security blocklist and is flagged by 17 of 95 security vendors on VirusTotal, including detection as a phishing or fraudulent site. The SSL certificate, issued by Google Trust Services (WE1), provides a veneer of legitimacy while failing to mitigate the underlying malicious intent. Infrastructure analysis further confirms the domain's association with Cloudflare, which, while not inherently malicious, is frequently leveraged to obscure hosting origins and evade takedown efforts. The domain's current offline status suggests either a temporary suspension due to enforcement actions or a strategic withdrawal by the threat actor to avoid further detection. However, the infrastructure remains a latent risk, as the domain could be reactivated or repurposed for future campaigns. Organizations and individuals are advised to block the domain and its associated IP (172.67.166.128) at the network level, including DNS and firewall rules. Users who interacted with the domain should assume credential compromise and initiate password resets for any accounts accessed during the exposure window. Monitoring for related domains registered through NiceNIC or resolving to Cloudflare IPs may help preemptively identify similar threats. Given the elevated risk level, security teams should prioritize reviewing logs for connections to this domain or its IP, particularly in environments where cryptocurrency transactions are common.