roam-token[.]ai-cryptolist[.]org

This domain, roam-token.ai-cryptolist.org, is identified as a phishing infrastructure impersonating OKX, a cryptocurrency exchange platform. Analysis indicates the site employs brand impersonation tactics to deceive users into divulging sensitive credentials or transferring digital assets. The presence of technologies such as IPFS, Vue.js, and Cloudflare suggests the use of modern, evasive techniques to bypass traditional security measures and maintain operational resilience. No specific drainer kit was conclusively identified, though the observed infrastructure aligns with known phishing toolkits targeting cryptocurrency users.

Technical indicators reveal the domain was registered through Key-Systems GmbH on April 11, 2026, and currently resolves to the IP address 188.114.96.3. VirusTotal detection metrics report 17 out of 95 security vendors flagging the domain as malicious, indicating moderate consensus on its threat status. The domain appears on a single security blocklist, and its SSL certificate is issued by Google Trust Services. Google Safe Browsing (GSB) status was not explicitly provided, though the domain’s inclusion in multiple detection engines underscores its risk profile.

As of the latest assessment, roam-token.ai-cryptolist.org has been taken offline, likely in response to security vendor interventions or registrar enforcement actions. The domain’s page title, 'Just a moment...,' suggests the use of Cloudflare protection or a placeholder status during operational downtime. Despite its current offline state, residual risk persists due to the domain’s recent registration and historical malicious activity. Organizations and users are advised to monitor for re-emergence, block the domain and associated IP at perimeter defenses, and conduct retrospective log analysis to identify prior exposure or compromise attempts.