acestokens[.]com

PhishDestroy identifies acestokens.com as an active brand impersonation domain targeting OKX users. The domain mimics the legitimate OKX exchange branding to deceive visitors into connecting cryptocurrency wallets or entering login credentials, likely facilitating funds theft via a crypto drainer kit. While the exact drainer payload has not been recovered, the site’s structure and branding alignment with OKX suggest a high-fidelity imitation intended for credential harvesting and wallet draining operations. This domain was registered through Namecheap Inc on October 14, 2024, and resolved to IP address 216.198.79.65. It carries a valid Let’s Encrypt SSL certificate for superficial legitimacy. As of the latest check, VirusTotal returns 0 detections out of 95 engines, indicating it remains undetected by most scanning tools. No entries were found in Google Safe Browsing (GSB), and blocklist counts remain at zero—highlighting a newly deployed threat with minimal static detection coverage. The domain is currently classified as active and under investigation by PhishDestroy. Users are strongly advised to avoid interacting with acestokens.com and to verify any OKX-related links using PhishDestroy’s real-time threat lookup. Remaining risk remains high given the absence of detection and the use of trusted infrastructure (Namecheap, Let’s Encrypt). Immediate blocking and takedown requests have been escalated to hosting and registrar partners.