# spongetoken-xyz.pages.dev — SUSPICIOUS

> spongetoken-xyz.pages.dev is a crypto drainer impersonating OKX, flagged by 0 of 95 VirusTotal vendors. Verify safety using PhishDestroy before clicking.

## Summary
PhishDestroy identifies active brand impersonation on spongetoken-xyz.pages.dev, a domain currently under investigation for mimicking OKX. This malicious infrastructure exhibits high-risk characteristics targeting cryptocurrency users through deceptive branding tactics. The domain remains active and has not yet been detected by mainstream security vendors.    This domain was flagged by 0 of 95 VirusTotal vendors despite hosting a crypto drainer impersonating OKX. Registered through Cloudflare, Inc., it resolves to IP address 172.66.47.132 using a Google Trust Services SSL certificate. The infrastructure shows concerning trust scores given its active impersonation campaign and zero detections at time of analysis.    Immediate action is required due to the active status of this threat. Users should avoid all interactions with spongetoken-xyz.pages.dev and verify any OKX-related links using PhishDestroy. Blocklists should be updated to include this domain based on its impersonation of OKX and crypto drainer activity. Security teams should monitor for related infrastructure given the active status and zero detections across major security platforms.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)
- Target brand: OKX

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 172.66.47.132

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/36e9d7a4-ac43-465f-a9d4-ed0d80f4e03a
- PhishDestroy: https://phishdestroy.io/domain/spongetoken-xyz.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/spongetoken-xyz.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/spongetoken-xyz.pages.dev/
Last updated: 2026-03-28