token6900-coin[.]web[.]app

This domain, token6900-coin.web.app, is flagged for brand impersonation targeting OKX, a major cryptocurrency exchange. Analysis indicates the site promoted a fraudulent crypto presale under the guise of "TOKEN6900: Better Than SPX6900," leveraging the exchange’s reputation to deceive users. No direct evidence of a crypto drainer kit was observed, though the presale mechanism may have been designed to harvest credentials or misappropriate funds. Infrastructure analysis reveals the domain was registered through Google Firebase and resolves to the IPv6 address 2620:0:890::100. The SSL certificate is issued by Google Trust Services, and the site employed technologies including Firebase, HSTS, and HTTP/3. As of the latest scan, VirusTotal reported 0 detections out of 95 engines, though it appeared on one security blocklist. No creation date was publicly disclosed, and Google Safe Browsing did not flag the domain at the time of assessment. The domain has since been taken offline, likely in response to the blocklist detection. However, residual risk remains due to the potential for re-deployment under a similar infrastructure or domain variation. Users who interacted with the site are advised to monitor financial accounts for unauthorized transactions and revoke any connected wallet permissions. Organizations should update detection rules to include the observed indicators, including the IPv6 address and Firebase-hosted patterns associated with this campaign.