Is okxclaim-holdearntokenrewards.netlify.app a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a single-page "Hold & Earn" token rewards landing page. It invites visitors to check an estimated allocation by pasting a public wallet address or connecting a wallet. It presents a "Reward distribution pool" with a live countdown and a running feed of wallet allocations, and its apparent purpose is to promote a hold-to-earn token giveaway. The operator's revenue model is not stated.

Scam/Impersonation Risk

The contradictions here are confirmed and severe. Major threat-intelligence sources currently classify the site as malicious, including a browser-protection service that flags it for social engineering and several security vendors that independently detect it. The site is blacklisted on that basis, which is decisive for the assessment. The page content is consistent with the pattern behind those detections. The pool is presented as 10,000,000 tokens, of which about 3.7 million are shown as already distributed and about 6.3 million remain, with a countdown of just over four days. The live feed shows individual wallets receiving roughly 300,000 to 590,000 tokens each, all stamped "now". These are classic manufactured-urgency and social-proof mechanics, and nothing on the page lets a visitor verify them. The token is a generic "$TOKEN" placeholder, and the page tells the visitor to append a contract parameter to load token data, so no real token is identified. The hostname combines an exchange-style brand name with "claim" wording, which implies an association with a known crypto platform. Nothing on the page substantiates that association, and the site sits on a free shared hosting subdomain. The "read-only check, no signature or transaction" assurance covers only the allocation lookup. The step where rewards would actually be claimed is never explained, and that step is where wallet-drain and approval-phishing schemes typically operate. The automated behavioural sandbox did not observe drainer activity, cloaking or clipboard manipulation. That result does not clear the unexplained claim step, and it does not outweigh the confirmed external detections. Evidence:

• Domain provenance: the site's hosting-subdomain registration is about 15 days old, and its first web-archive capture was on 2026-10-05, with only 2 snapshots in 1 year tracked.
• Threat intelligence: 7 security engines flag the site as malicious, including two tier-one vendors, and the browser-protection service reports a social-engineering match.
• Homepage allocation panel: the status reads "Eligible" with a 0.00 estimate before any wallet has been checked, so eligibility is asserted rather than computed.
• Homepage wallet prompts: a "Connect wallet" call to action appears in the navigation and again in the results panel.

Regulatory Verification Notes

The page discloses no legal entity, team, audit, contract address, licence, registration number, funding source for the reward pool, or working contact channel, and the claims therefore cannot be tied to any accountable party. The real-world operator identity remains unverified. This site offers a crypto reward programme that would normally call for clear issuer and regulatory disclosure, and in this case the absence of that disclosure compounds the confirmed external detections rather than standing alone. No third-party broker or regulator record matches the site, so there is no independent reputational or licensing context to weigh. The site's transport security is valid, but it is an organisation-validated certificate issued to the hosting platform, so it does not authenticate the operator of this page. Evidence:

• Homepage and navigation: the "How it works" and "Security" sections name no company, jurisdiction, or terms of service.
• Hosting: served from AS16509 (AMAZON-02, Amazon.com, Inc., US).
• Transport encryption: the TLS certificate is OV-validated, issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 to Netlify, Inc, and valid to 2027-03-19.
• Page metadata: there is no meta description, canonical tag or structured data to indicate an established publisher.

What to Verify Next

Any claim of an exchange-linked or project-linked reward should be checked only through the official channels of the named platform, reached independently of this site, to see whether any such distribution exists. A real token would have a published contract address visible on a public blockchain explorer, along with an audited distribution mechanism. The pool size, the distributed amount and the claimed allocations should be checked against on-chain data, since the page's own counters and feed are unverifiable. Any entity that later claims responsibility should be checked against the relevant financial or virtual-asset registry, and its contact channels confirmed through an independent, offline route. Evidence:

• Homepage: no contract address is given, and the page asks the visitor to supply one through a URL parameter.
• Homepage reward panel: the pool counters and the allocation feed are generated on the page, with no linked on-chain source.
• Entire site: no verifiable contact channel, address or named responsible party is published.

Summary Verdict

The site carries an elevated, clearly cautionary risk posture. Confirmed external threat detections combine with a very recently created site, unverifiable reward mechanics and an unidentified operator. Mainstream technical hygiene does not offset these findings, and the apparent legitimacy of the presentation is not supported by any evidence of an accountable entity.

Infrastructure Integrity

The site is served from Amazon's cloud network through a CDN/WAF layer on a shared hosting platform, with four edge addresses observed and no origin server visible. This protective infrastructure is a mitigating factor only and does not offset the reputation risk. Two abuse reports exist against one of the shared edge addresses, but they apply to shared provider infrastructure rather than to this site specifically, so they carry no weight here. Edge-only visibility also prevents independent verification of the hosting and means content could be swapped quickly without any change in the infrastructure footprint.

Closing Assessment

The site should not be used for wallet connection, address submission, credential entry or any financial interaction, and no signing prompt or approval should be accepted from it. Anyone who has already connected a wallet or approved a transaction should revoke token approvals, move assets to a new wallet if exposure is possible, and report the page to the hosting platform and to the exchange whose name its hostname invokes.

Signals weighed against the site

• AbuseIPDB: 2 reports on hosting IP 2a05:d014:58f:6200::259 (Amazon Data Services Ireland Ltd, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.