Is okxclaim-earnhodltokenrewards.netlify.app a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Google, Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a single-page crypto token-rewards checker branded "Token Rewards — Hold & Earn". It asks visitors to paste a public wallet address or connect a wallet to see an "estimated allocation" of a placeholder-named $TOKEN. The page presents a reward distribution pool with a live countdown and a scrolling feed of wallet payouts. Its apparent purpose is to draw holders into wallet-connection and claim flows, and it names no operator or revenue model.

Scam/Impersonation Risk

The risk is elevated, with confirmed adverse reputation signals that bear directly on this site. The address is blacklisted: a major browser-safety service flags it for social engineering, and several security vendors, including two top-tier ones, independently classify it as malicious. Those detections outweigh the valid transport encryption and the clean-looking page behavior. The page's own mechanics fit a claim-style lure. It advertises a 10,000,000-token initial pool with roughly 3.7 million "distributed" and about 6.3 million remaining. A countdown of under five days creates urgency. A "live updates" feed shows eight different wallets receiving large payouts, each stamped "now". The feed is uniform and cannot be tied to any chain explorer or ledger. The checker also reports "Eligible" next to a 0.00 allocation, and it pairs a "read-only, no signature or transaction" assurance with repeated "Connect wallet" prompts. The page offers no audit, tokenomics source, team, issuer, or contact channel to back any of this. The hostname combines the strings "okx", "claim", "earn", "hodl" and "token rewards" on a free hosting subdomain. That evokes a well-known exchange brand, but no confirmed impersonation or conflicting legal identity was observed. The adverse picture rests on the blacklisting and the claim-versus-evidence gap. The few abuse reports tied to an address in the hosting provider's shared range are not attributable to this site and carry no weight here. Evidence:

• Homepage: the pool figures, countdown and live allocation feed are presented with no issuer, audit, or verifiable source.
• Homepage: the "read-only, no signature or transaction" notice sits beside repeated wallet-connection prompts and a countdown.
• Domain provenance: registered about 14 days ago, with only 2 archive snapshots, both captured in October 2026 (about 1 year tracked).
• Reputation: a browser-safety match for social engineering, 4 malicious vendor verdicts including 2 top-tier vendors, and 2 abuse reports on a shared provider address (discounted).

Regulatory Verification Notes

The site claims no license, registration, or regulatory status, and no third-party regulatory or broker record was matched. The page names no legal entity, operator, jurisdiction, or terms of service, so a visitor cannot determine who runs the reward program or who is liable for it. This is a verification gap rather than a contradiction between identity pages. For a program that asks for wallet interaction, however, it compounds the reputational findings. The site's operator identity remains unverified, and nothing on the page lets a visitor connect it to a real-world person or company. The valid, organization-validated certificate belongs to the hosting platform and says nothing about the reward program's operator. Evidence:

• Homepage: no company name, license, registration number, legal terms, or contact details are published.
• Transport encryption: an OV certificate issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 to Netlify, Inc, valid to 2027-03-19.
• Hosting: served from AS16509 (AMAZON-02, Amazon.com, Inc., US).

What to Verify Next

Any claim of eligibility should be checked outside this site. The reward program should be traced to an official announcement on a channel the visitor reaches independently, not through links on this page. The token's contract should be confirmed on a public chain explorer, with the pool balance and payout transactions compared against the page's figures. An independent audit or a named, identifiable issuer should be located through an offline route before any wallet is linked. If the domain was reached through a message or advertisement, that sender should be treated as unverified, and the site's own contact channels should not be relied on to authenticate it. Evidence:

• Homepage: the pool, distributed, and initial-pool figures are available for comparison against on-chain records.
• Homepage: wallet addresses in the live feed are truncated and can be looked up on a chain explorer.
• Homepage: no official social or documentation links are published to validate the program.

Summary Verdict

The overall posture is clearly cautionary. Confirmed third-party threat detections, together with a page built around unverifiable reward claims and urgency cues, outweigh the technically sound surface of the site. Its apparent legitimacy is not supported, and its operator remains unidentified.

Infrastructure Integrity

The site sits behind AWS-hosted CDN/WAF infrastructure in the US, and all observed addresses are edge servers. The origin server was not observable. This protective layer is a mitigating factor only. It offers no assurance about the content served, and edge-only visibility can mask rapid content changes. It cannot offset the external threat detections. Evidence:

• Hosting infrastructure: 4 edge addresses, all within AS16509, with no origin candidates observed.

Closing Assessment

The site should be limited to passive viewing at most. No wallet should be connected, no address submitted, and no credentials or funds committed through it. Anyone who already interacted with it should review and revoke wallet permissions and move assets to a fresh wallet.

Signals weighed against the site

• AbuseIPDB: 2 reports on hosting IP 2a05:d014:58f:6200::259 (Amazon Data Services Ireland Ltd, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.