# xtoken-market.org — SUSPICIOUS

> PhishDestroy identifies xtoken-market.org as an active OKX impersonation scam. Domain resolves to 104.21.88.166 and was created March 13, 2026.

## Summary
PhishDestroy identifies xtoken-market.org as an active brand impersonation site targeting OKX users. This domain was flagged under seed fde539 for impersonating the global cryptocurrency exchange OKX to deceive victims into entering credentials or transferring funds. While no drainer kit payloads were detected during initial analysis, the site is engineered to mimic OKX’s legitimate trading interface, including design elements and domain string similarity, to establish false legitimacy.  

Exact technical indicators corroborate the threat: VirusTotal currently shows 0 detections out of 95 engines, the domain was registered through Global Domain Group LLC via Let’s Encrypt SSL, resolves to IP 104.21.88.166, and was created on March 13, 2026. As of this report, the domain has not been blocked by Google Safe Browsing (GSB) and does not appear on major public blocklists. The lack of detections highlights the risk of delayed threat recognition, emphasizing the need for proactive monitoring.  

Current status remains active with ongoing monitoring under seed fde539. PhishDestroy recommends immediate user avoidance and domain takedown requests to hosting providers and registrars. Remaining risk is classified as high due to the combination of recent registration, active hosting, unflagged status, and direct OKX brand targeting. Users encountering this domain should report it to Google Safe Browsing, their browser vendor, and OKX’s abuse channels to enhance collective defense against evolving impersonation campaigns.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)
- Target brand: OKX
- Page title: xtoken-market.org

## Domain Intelligence
- Registered: 2026-03-13 16:49:47
- Registrar: Global Domain Group LLC
- IP: 104.21.88.166

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/c1c280a6-5fe3-4c42-8c14-69807b330fd1
- PhishDestroy: https://phishdestroy.io/domain/xtoken-market.org/
- LLM endpoint: https://phishdestroy.io/domain/xtoken-market.org/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/xtoken-market.org/
Last updated: 2026-03-21