io-exchangetoken[.]icu

This domain is flagged as a high-risk brand impersonation site specifically targeting OKX, a major cryptocurrency exchange platform. Analysis indicates the site was designed to deceive users into believing they are interacting with legitimate OKX services, likely for the purpose of credential theft or unauthorized transaction manipulation. The threat type is classified as brand impersonation, with no evidence of direct crypto drainer functionality at this time, though such capabilities cannot be ruled out in secondary payloads. Infrastructure analysis reveals multiple concerning indicators. The domain was registered through PDR Ltd. d/b/a PublicDomainRegistry.com and resolves to the IP address 188.114.97.3. It is currently offline but was previously detected on three security blocklists, including MetaMask and PhishDestroy. The page title was recorded as 'Success!', a common tactic to mislead users into believing a transaction or login attempt was completed. Gridinsoft assigned a trust score of 0/100, while VirusTotal shows 0/95 detections, though this may reflect limited scanning coverage rather than benign status. AlienVault OTX lists the domain in two threat intelligence pulses, confirming its association with malicious campaigns. Technologies detected include Cloudflare and HTTP/3, which may have been leveraged to obscure infrastructure details or evade detection. Mitigation steps for this specific threat type include immediate domain blacklisting across all network security layers, particularly for organizations handling cryptocurrency transactions. Users who may have interacted with the site should revoke any active session tokens, reset credentials for associated accounts, and monitor for unauthorized transactions. Security teams should prioritize hunting for related indicators, such as the resolving IP 188.114.97.3 and registrar PDR Ltd., which may be reused in future campaigns. Given the domain's association with OKX impersonation, additional scrutiny should be applied to any communications or websites claiming affiliation with the exchange, especially those using similar naming conventions or Cloudflare-hosted infrastructure.