growtoken[.]xyz

This domain, growtoken.xyz, is confirmed as an active phishing site targeting the OKX cryptocurrency brand. Registered on February 21, 2026, through Go Daddy, LLC, the domain is currently resolving to IP address 76.76.21.21, which is hosted by Vercel, Inc in the United States. The page title is 'GrowDao - Decentralized Ecosystem for Web3 Financial Solutions,' but the brand target is explicitly identified as OKX, indicating a deliberate attempt to deceive users seeking legitimate OKX services. The SSL certificate is issued by Let's Encrypt with identifier YR2, and the site returns a 308 redirect status, suggesting the page may redirect visitors to a phishing interface. VirusTotal detection shows 1 out of 95 security vendors flagging the domain, and it appears on one security blocklist. The Gridinsoft trust score is 0 out of 100, reinforcing the malicious assessment. Infrastructure analysis reveals the use of Vercel as a hosting provider, with HSTS enabled, and nameservers pointing to ns29.domaincontrol.com and ns30.domaincontrol.com, both associated with Go Daddy. The domain is blocked by PhishDestroy, a security blocklist, confirming its threat status. The low detection rate on VirusTotal may indicate the site is newly active or uses evasion techniques, but the single vendor flag and zero trust score are strong indicators of malicious intent. Defenders should immediately block access to growtoken.xyz at the network level, particularly for users involved in cryptocurrency transactions. Organizations should monitor logs for connections to this domain and educate users about impersonation risks, especially those related to OKX. The active status and recent creation date suggest the site may still be used in ongoing campaigns, requiring continuous monitoring and updates to threat intelligence feeds.