enter-token[.]xyz

The domain enter-token.xyz was registered on April 26, 2026 through Dynadot LLC and is currently marked as active. It is being used to impersonate the cryptocurrency exchange OKX, constituting a brand‑impersonation campaign classified as high risk. Infrastructure analysis shows the domain resolves to IP address 172.67.188.22, which belongs to Cloudflare, Inc. and is geolocated to Canada. DNS resolution is served by the Cloudflare nameservers dayana.ns.cloudflare.com and guss.ns.cloudflare.com. The site presents a valid Let's Encrypt certificate (issuer E8) but returns an HTTP 403 status code for direct requests. Threat intelligence sources corroborate the malicious intent. VirusTotal records indicate that 3 of 95 security vendors have flagged the domain, and Gridinsoft assigns a trust score of 0 out of 100. The domain appears on a single security blocklist and has been blocked by PhishDestroy. Additionally, AlienVault OTX lists the domain in one threat‑intelligence pulse. Defenders should immediately add enter-token.xyz and its resolved IP 172.67.188.22 to network blocklists and configure email filters to detect and quarantine communications that reference OKX branding alongside this domain. Continuous monitoring of Cloudflare‑associated IP ranges and DNS changes is advised, as the infrastructure can be shifted behind the same provider. End‑user awareness campaigns that highlight the spoofed OKX brand and the unusual domain pattern can further reduce exposure.