# PhishDestroy threat dossier — tokensrev.xyz ================================================================ Fetched: 2026-07-06 15:16:25 UTC Canonical: https://phishdestroy.io/domain/tokensrev.xyz/ ## VERDICT ---------------------------------------------------------------- ACTIVE + CLOAKED — returns HTTP 666 to scanners, real fraudulent site to victims Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) Scam classification: Airdrop Scam Targeted brand: OKX Cloaking: DETECTED — domain returns custom HTTP 666 to scanners while serving fraudulent content to real users (type: content_divergence) (score: 2/6) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 0/91 security vendors flagged this domain Flagging vendors: Emsisoft, Forcepoint ThreatSeeker, Fortinet, Netcraft, Webroot AlienVault OTX: 1 pulses (threat-intel feed mentions) Public blocklists: listed on 3 independent blocklists ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 188.114.97.3 (US, San Francisco) ASN: AS13335 Cloudflare, Inc. Hosting org: AS13335 Cloudflare, Inc. Registrar: OwnRegistrar, Inc. Nameservers: may.ns.cloudflare.com, sevki.ns.cloudflare.com Registered: 2026-07-05 Expires: 2027-07-05 Page title: Hyperliquid l Airdrop HTTP response: 200 ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-07-05 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-07-06 14:12:01 UTC (by PhishDestroy tracker) Last verified: 2026-07-06 17:00:13 UTC Current status: ACTIVE — cloaked behind HTTP 666 to evade scanners ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019f3756-30df-741b-a4e0-cf483f2482d1/ Wayback Machine: https://web.archive.org/web/*/tokensrev.xyz crt.sh CT logs: https://crt.sh/?q=%25.tokensrev.xyz Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=tokensrev.xyz AlienVault OTX: https://otx.alienvault.com/indicator/domain/tokensrev.xyz URLhaus: https://urlhaus.abuse.ch/host/tokensrev.xyz/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-06 14:16:27 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] This domain, tokensrev.xyz, is actively engaged in brand impersonation targeting OKX, a major cryptocurrency exchange platform. The site presents itself under the guise of a 'Hyperliquid Airdrop,' a tactic commonly used to lure users into interacting with fraudulent interfaces designed to compromise crypto wallets or steal credentials. The specific threat posed involves crypto drainer mechanisms or credential harvesting, where victims may unknowingly authorize transactions or disclose sensitive information, leading to unauthorized access and asset theft. The use of airdrop-themed lures is a recurring strategy in crypto-related phishing campaigns, exploiting user interest in free token distributions to bypass skepticism. Analysis of the domain reveals multiple technical indicators supporting its malicious classification. tokensrev.xyz was registered on July 05, 2026, through OwnRegistrar, Inc., a registrar frequently associated with high-risk domains. The domain resolves to the IP address 188.114.97.3 and uses an SSL certificate issued by Google Trust Services, which, while providing encryption, does not validate the legitimacy of the site. VirusTotal detection metrics show that 5 out of 95 security vendors have flagged the domain as malicious, a modest but notable signal given the platform's conservative scoring thresholds. The page title, 'Hyperliquid l Airdrop,' further corroborates the impersonation theme, as it mimics legitimate airdrop announcements while omitting any affiliation with the actual OKX or Hyperliquid platforms. Users who have visited tokensrev.xyz or interacted with its content should take immediate remedial actions to mitigate potential risks. First, disconnect any connected wallets or sessions from the domain and revoke any suspicious token approvals using blockchain explorers or wallet management tools. Monitor accounts for unauthorized transactions and enable multi-factor authentication where available. If credentials were entered, reset passwords immediately and avoid reusing them across platforms. Report the domain to relevant blocklists or security communities to aid in broader threat mitigation. Given the elevated risk level and active status of this infrastructure, vigilance and proactive measures are critical to preventing financial loss or further compromise. ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/tokensrev.xyz/ JSON API: https://api.destroy.tools/v1/check?domain=tokensrev.xyz Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 175,439 domains (13,735 alive under monitoring, 160,779 confirmed takedowns/dead). Site: https://phishdestroy.io