aevotoken[.]live

This domain, aevotoken.live, is currently under investigation for brand impersonation targeting OKX, a major cryptocurrency exchange platform. The domain exhibits characteristics consistent with fraudulent activity designed to deceive users into believing they are interacting with legitimate OKX services. Analysis indicates the domain remains active and unflagged by most security vendors, posing a potential risk to unsuspecting users. Infrastructure analysis reveals the domain was registered on June 28, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to the IP address 216.198.79.1, which has not been widely blocklisted at this time. VirusTotal reports 0 detections out of 95 security vendors, suggesting the domain has not yet been broadly identified as malicious. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites due to its accessibility. AlienVault OTX has recorded the domain in one threat intelligence pulse, indicating preliminary awareness within the security community. Current risk assessment places this domain in an ambiguous state due to limited detection and blocklisting. However, the combination of brand impersonation, recent registration, and lack of widespread flagging warrants caution. Organizations and users are advised to monitor network traffic for connections to aevotoken.live and its associated IP address. Security teams should consider implementing DNS-based blocking or web filtering rules to prevent access. Users should verify the authenticity of any communication or website claiming affiliation with OKX by cross-referencing official channels. If interaction with the domain has occurred, affected parties should review account activity for unauthorized transactions and reset credentials as a precautionary measure.