# checktoken.live — SUSPICIOUS

> checktoken.live is a fake OKX site pushing a crypto drainer; avoid it. Only trust pages linked from OKX’s official site or PhishDestroy’s verified list.

## Summary
PhishDestroy identifies checktoken.live as a live domain actively impersonating OKX, a major cryptocurrency exchange. Security teams have flagged the site as a potential crypto drainer, designed to trick visitors into connecting wallets or entering credentials that attackers can then exploit. The threat is active, and the domain’s recent creation and low detection rate make it especially dangerous for unsuspecting users seeking legitimate OKX services.  This domain was flagged on seed 118275 with 0 detections on VirusTotal out of 95 scanners, indicating it remains under the radar despite active abuse. checktoken.live was registered on April 01, 2026, through GoDaddy.com, LLC, and currently resolves to IP 77.245.76.110. It uses a Let’s Encrypt SSL certificate to appear legitimate, adding to its deceptive credibility. Given these technical indicators and the site’s recent deployment, it poses a medium-to-high risk to visitors, particularly those unfamiliar with verifying domain authenticity.  If you visited checktoken.live, immediately disconnect any connected wallets and revoke any unauthorized permissions through your wallet’s security settings. Do not enter login credentials or interact with any transaction prompts. Scan your device with updated antivirus software and monitor financial accounts for suspicious activity. Report the domain to PhishDestroy for analysis and avoid clicking links from unsolicited emails or social media messages claiming to be from OKX. Always access official platforms directly via bookmarked links or verified domains.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)
- Target brand: OKX

## Domain Intelligence
- Registered: 2026-04-01 10:50:15
- Registrar: GoDaddy.com, LLC
- IP: 77.245.76.110

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/eab4cbd7-4476-4abf-b3d4-6c408b342ce5
- PhishDestroy: https://phishdestroy.io/domain/checktoken.live/
- LLM endpoint: https://phishdestroy.io/domain/checktoken.live/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/checktoken.live/
Last updated: 2026-04-01