io-tokenexchange[.]icu

The domain io-tokenexchange.icu is identified as a brand_impersonation threat specifically targeting OKX, a major cryptocurrency exchange platform. Analysis confirms this domain was actively impersonating OKX services to deceive users into disclosing sensitive credentials or transferring digital assets. Currently, the domain is offline, though prior activity indicates it was operational for malicious purposes. Infrastructure analysis reveals multiple technical indicators supporting its fraudulent nature. The domain was flagged by 2 of 95 security vendors on VirusTotal, while Gridinsoft assigned it a trust score of 0 out of 100. It appears on three security blocklists and was registered through PDR Ltd. d/b/a PublicDomainRegistry.com on June 05, 2026. The domain resolved to the IP address 104.21.86.167, a network segment frequently associated with malicious activity. Additional threat intelligence confirms its presence in four AlienVault OTX pulses, further corroborating its classification as a high-risk impersonation site. Given the domain's current offline status, immediate interaction risks are mitigated. However, users should remain vigilant as threat actors may reactivate similar domains under different names. Organizations and individuals are advised to implement proactive monitoring for domains mimicking OKX branding, particularly those registered through high-risk registrars. Network administrators should block the IP 104.21.86.167 and related infrastructure to prevent potential compromise. End-users should verify domain authenticity through official channels before engaging with any cryptocurrency-related platforms.