vame[.]be

This domain, vame.be, is actively engaged in brand impersonation targeting users of the cryptocurrency exchange OKX. The site presents itself as a legitimate platform offering a "BTC Airdrop — $100 Reward for Active Traders," a common tactic to lure victims into interacting with malicious smart contracts or wallet-draining scripts. Analysis indicates the domain is designed to harvest wallet credentials, private keys, or seed phrases, enabling attackers to siphon cryptocurrency assets from compromised accounts. The use of a fabricated airdrop promotion is a well-documented social engineering technique to exploit user greed and urgency, increasing the likelihood of successful exploitation. Infrastructure analysis reveals the domain was registered on June 12, 2026, through an undisclosed registrar, and currently resolves to the IP address 160.153.133.172. The SSL certificate is issued to "vame / vame.be," providing a superficial layer of legitimacy while failing to prevent detection by security systems. As of the latest assessment, vame.be is flagged by 19 out of 95 security vendors on VirusTotal, indicating a high confidence level in its malicious nature. Additionally, the domain appears on three independent security blocklists, further corroborating its classification as a high-risk threat. The combination of brand impersonation, active blocklist presence, and detection by multiple security engines underscores the sophistication and persistence of this campaign. Users who have visited vame.be or interacted with its content are advised to take immediate remedial action. First, disconnect any wallets or accounts that may have been linked to the domain and revoke any suspicious smart contract approvals using a trusted blockchain explorer. Second, monitor all connected accounts for unauthorized transactions and report any anomalies to the respective platform. Third, scan the affected device for malware or unauthorized access using updated security tools. If credentials or private keys were entered on the site, assume they are compromised and migrate assets to a new, secure wallet. Finally, report the domain to relevant security communities and blocklist providers to aid in mitigation efforts and prevent further victimization.