karatsu[.]verifytoken[.]com

PhishDestroy identifies karatsu.verifytoken.com as an active domain engaged in brand impersonation of OKX, specifically targeting users with a fake token verification scheme. The domain is currently under investigation as part of a broader campaign aimed at deceiving individuals into divulging sensitive credentials or financial information. This threat is classified as a high-risk impersonation due to its direct mimicry of a major cryptocurrency exchange platform, posing significant risks to user trust and security.

This domain was flagged by 17 of 95 VirusTotal vendors, indicating it remains undetected across major security platforms as of the latest scan. Registered through MarkMonitor, Inc., the domain resolves to IP address 34.194.247.17 and operates under a Let's Encrypt SSL certificate. The domain was created on March 21, 2011, and has not been identified on any known blocklists, with current trust scores remaining unassessed due to its low detection rate. Despite its age, the domain's recent activity and lack of detection suggest a deliberate attempt to evade traditional security measures.

As this threat remains active, organizations and individuals are strongly advised to immediately block access to karatsu.verifytoken.com at the network and endpoint levels. Users should verify the authenticity of any OKX-related communications by cross-referencing official channels and be cautious of unsolicited requests for token verification. Implementing domain-based security policies and monitoring for similar impersonation attempts is critical to mitigating potential exposure. Further intelligence and IOCs are available in the full report for deeper analysis.