token2049-stellar[.]com

This domain, token2049-stellar.com, was identified as an elevated-risk brand impersonation threat specifically targeting OKX, a major cryptocurrency exchange. The site masqueraded as the legitimate TOKEN2049 event page for October 2025, but its true intent was to harvest credentials or sensitive information from unsuspecting visitors. PhishDestroy flagged this domain due to clear signs of fraudulent activity, including a suspiciously recent creation date and malicious indicators detected by multiple security vendors.

Technical analysis reveals that token2049-stellar.com was registered on September 12, 2025, through Hosting Concepts B.V. d/b/a Registrar.eu, and resolved to IP address 216.198.79.1. VirusTotal data shows that 3 out of 95 security vendors flagged the domain as malicious, and it appears on one security blocklist. The SSL certificate was issued by Let's Encrypt (R12), which is common for both legitimate and malicious sites. Despite the page title reading "TOKEN2049 | 1-2 October 2025 | Singapore," the domain is currently offline, indicating that action has been taken to mitigate the threat.

To protect against such phishing attacks, users should always verify the authenticity of websites by checking the URL carefully, especially when dealing with cryptocurrency platforms like OKX. Never enter login credentials or private keys on sites accessed through unsolicited links. Enable two-factor authentication on all accounts and report any suspicious domains to relevant authorities or security platforms. PhishDestroy recommends that organizations monitor for similar domain registrations and educate users about brand impersonation tactics.