buypsatoken[.]com

This domain, buypsatoken.com, is confirmed as a high-risk brand impersonation site targeting OKX, a major cryptocurrency exchange. Analysis indicates the site employs deceptive design elements to mimic legitimate OKX login and transaction pages, likely aiming to harvest credentials or facilitate unauthorized fund transfers. The page title 'Axiom' suggests potential use of a modular phishing kit, though no specific drainer family was conclusively identified in available telemetry. The domain does not exhibit overt crypto drainer functionality but aligns with credential theft and social engineering tactics commonly deployed against financial platforms. Infrastructure analysis reveals the domain was registered on May 26, 2026, through TUCOWS.COM, CO., a registrar frequently exploited for malicious registrations due to its bulk registration capabilities. The domain resolves to IP address 188.114.96.3, a host with a history of association with phishing infrastructure. VirusTotal detection metrics show 13 out of 95 security vendors flagging the domain as malicious, indicating moderate but consistent cross-industry recognition of its harmful nature. The domain appears on three independent security blocklists and is referenced in four AlienVault OTX threat intelligence pulses, further corroborating its malicious classification. At the time of analysis, the domain was not listed in Google Safe Browsing databases, though this may reflect a lag in propagation rather than benign status. Current status indicates the domain has been taken offline, likely as a result of coordinated takedown efforts or registrar intervention following abuse reports. The domain is blocked by multiple browser-based security extensions and threat intelligence feeds, reducing immediate exposure to end users. However, residual risk persists due to the transient nature of such infrastructure; threat actors may re-deploy the phishing kit under a new domain or IP with minimal modification. Users are advised to verify all cryptocurrency transaction URLs against official sources, enable multi-factor authentication on exchange accounts, and monitor for unauthorized access attempts. Organizations should update blocklists with this domain and associated IP to prevent future exposure.